Hands-on project: build a small office network from scratch
Lesson 5 of 6
5Hands-on project: build a small office network from scratch
The big pictureThe owner of a 20-person accounting office asks you: "I want a network for staff, guest Wi-Fi that cannot see our machines, and separate cameras". It is a real request every junior network engineer gets, and you will build it completely on your computer now without buying a single device.
What the picture shows: Six stages in order, each with a test before you move on. If a test fails, you know the problem is in the last step only.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Imagine splitting a big house into three flats: each flat has a door and a number (that is a VLAN and its addresses), and between them a corridor with a guard (the router and the ACL) who lets the guest out to the street but not into the staff flats, and a receptionist who hands every visitor a room number automatically (DHCP). On the plain path you will not type many commands; it is enough to understand the plan and draw it on paper: three groups, the road for each, and who is blocked from what.
The topology: router R1 with one interface towards switch SW1 (router-on-a-stick with 802.1Q subinterfaces), SW1 with access ports for each VLAN and a trunk to the router, and a wireless access point for guests. The plan: VLAN 10 staff 192.168.10.0/24, VLAN 20 guests 192.168.20.0/24, VLAN 30 cameras 192.168.30.0/24, and VLAN 99 management. R1 serves DHCP for each VLAN excluding the first ten addresses, and an extended ACL on the guest subinterface denies 192.168.10.0/24 and 192.168.30.0/24 and permits the rest. Remote management over SSHv2 only with transport input ssh, and passwords stored with secret. Verify with show vlan brief, show interfaces trunk, show ip dhcp binding and show access-lists.
Before You Start
🧱Switching and VLANs
You know access and trunk ports and the 802.1Q tag.
🛡️Network security
You know access control lists.
🔎Diagnostic tools
You use the troubleshooting ladder, ping and traceroute.
The Core Idea
1Plan on paper first
The most common beginner mistake is opening the program and starting to type. Draw the addressing table first: for each VLAN its number, name, network, gateway and DHCP range. That table is half your documentation, and every step after it is just translating it into commands.
| VLAN | Name | Network | Gateway | DHCP |
|---|---|---|---|---|
| 10 | STAFF | 192.168.10.0/24 | 192.168.10.1 | .11 – .254 |
| 20 | GUEST | 192.168.20.0/24 | 192.168.20.1 | .11 – .254 |
| 30 | CAMERAS | 192.168.30.0/24 | 192.168.30.1 | .11 – .254 |
| 99 | MGMT | 192.168.99.0/24 | 192.168.99.1 | Static |
Generate your table instead of working it out by hand. Try making the guest network a /25 instead of a /24.
import ipaddress
plan = {10: "STAFF", 20: "GUEST", 30: "CAMERAS", 99: "MGMT"}
for vlan, name in plan.items():
net = ipaddress.ip_network(f"192.168.{vlan}.0/24")
hosts = list(net.hosts())
gateway, pool = hosts[0], hosts[10:]
print(f"VLAN {vlan:<3} {name:<8} {str(net):<17} gw {str(gateway):<14} "
f"DHCP {pool[0]} - {pool[-1]} ({len(pool)} addresses)")2The switch: VLANs and ports
Create the VLANs and name them, put each port in its users' VLAN, and make the port towards the router a trunk carrying every network with 802.1Q tags. Shut the unused ports and park them in an unused VLAN: an open port in the wall is a door for any stranger.
This stage's test: two machines in VLAN 10 reach each other, and a machine in VLAN 20 cannot reach them (no routing yet).
SW1(config)# vlan 10 SW1(config-vlan)# name STAFF SW1(config-vlan)# vlan 20 SW1(config-vlan)# name GUEST SW1(config-vlan)# vlan 30 SW1(config-vlan)# name CAMERAS SW1(config)# interface range fa0/1 - 12 SW1(config-if-range)# switchport mode access SW1(config-if-range)# switchport access vlan 10 SW1(config)# interface fa0/20 SW1(config-if)# switchport access vlan 20 SW1(config)# interface gi0/1 SW1(config-if)# switchport mode trunk SW1(config)# interface range fa0/13 - 19 SW1(config-if-range)# shutdown SW1# show vlan brief SW1# show interfaces trunk
3The router: routing and DHCP
The router needs a "door" in every VLAN: a subinterface per network with its tag and gateway. Then it becomes the DHCP server handing out addresses and telling each machine its gateway and DNS server.
Repeat the subinterface and DHCP pool for every VLAN. The test: every machine gets an address automatically, and a staff machine reaches a guest one (we block that next).
R1(config)# interface gi0/0.10 R1(config-subif)# encapsulation dot1Q 10 R1(config-subif)# ip address 192.168.10.1 255.255.255.0 R1(config)# interface gi0/0.20 R1(config-subif)# encapsulation dot1Q 20 R1(config-subif)# ip address 192.168.20.1 255.255.255.0 R1(config)# interface gi0/0 R1(config-if)# no shutdown R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10 R1(config)# ip dhcp pool STAFF R1(dhcp-config)# network 192.168.10.0 255.255.255.0 R1(dhcp-config)# default-router 192.168.10.1 R1(dhcp-config)# dns-server 1.1.1.1 R1# show ip dhcp binding
no shutdown on the parent interface gi0/0. Subinterfaces do not work while the parent is shut.4Security, testing and documentation
Now apply the client's request: guests go out to the internet but reach neither staff nor cameras. Put an extended ACL close to the source, on the guest subinterface in the inbound direction. Then close Telnet and allow management over SSH only. Finally write a test matrix: who should reach whom, and what actually happened.
Line order matters: an ACL is read top down and ends with an implicit "deny everything", so permit goes last. The password here is only an example.
R1(config)# ip access-list extended GUEST-IN R1(config-ext-nacl)# deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255 R1(config-ext-nacl)# deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 R1(config-ext-nacl)# permit ip any any R1(config)# interface gi0/0.20 R1(config-subif)# ip access-group GUEST-IN in R1(config)# ip domain-name office.example R1(config)# crypto key generate rsa modulus 2048 R1(config)# ip ssh version 2 R1(config)# username admin secret Str0ng-Example! R1(config)# line vty 0 4 R1(config-line)# login local R1(config-line)# transport input ssh
A FAIL here means the camera deny line was forgotten or came after the permit. Put your real results in observed.
# The test matrix: what should happen, then what your pings showed.
expected = {("STAFF", "GUEST"): True, ("GUEST", "STAFF"): False,
("GUEST", "CAMERAS"): False, ("GUEST", "INTERNET"): True,
("STAFF", "CAMERAS"): True}
observed = {("STAFF", "GUEST"): True, ("GUEST", "STAFF"): False,
("GUEST", "CAMERAS"): True, ("GUEST", "INTERNET"): True,
("STAFF", "CAMERAS"): True}
for (src, dst), want in expected.items():
got = observed[(src, dst)]
mark = "PASS" if got == want else "FAIL"
print(f"{mark} {src:<6} -> {dst:<9} expected {'reach' if want else 'blocked':<7} got {'reach' if got else 'blocked'}")Worked example
The task: after the build, a guest machine got 169.254.12.7 and cannot browse. Staff machines work. Where is the problem?
The answer: a 169.254.x.x address means the machine never reached a DHCP server. Climb the ladder: (1) is the port connected? (2) show vlan brief: is the guest port in VLAN 20? (3) show interfaces trunk: is VLAN 20 allowed on the trunk? (4) does subinterface gi0/0.20 exist with the right tag? (5) is there a DHCP pool for 192.168.20.0? Here the pool existed but the trunk allowed only VLANs 10 and 30. After switchport trunk allowed vlan add 20 the machine got 192.168.20.11.
Myth vs Reality
| Myth | Reality |
|---|---|
| A simulator lab does not count as experience. | A documented Packet Tracer project proves you plan, build and test, which is what interviewers ask about. |
| VLANs alone are enough to isolate guests. | As soon as the router routes between them they connect. Real isolation needs an ACL or a firewall. |
| Documentation is a luxury after the work. | It is part of the work; without it nobody can fix the network after you, not even you in six months. |
Where you meet it at work
🏢Small offices
This same design runs in thousands of clinics, offices and shops.
🎓Your first interview
"Walk me through something you built" is a certain question; this is your answer.
🧪CCNA preparation
Covers VLANs, inter-VLAN routing, DHCP, ACLs and SSH hands-on.
Test your understanding
A machine got a 169.254.x.x address. What does that mean?
It is an address a machine gives itself when it finds no DHCP.
Where do you place an extended ACL that blocks guests from staff?
An extended ACL names source and destination precisely, so it goes near the source to drop traffic early.
An ACL has permit ip any any first, then two deny lines. What happens?
An ACL is read top down and stops at the first match.
What is router-on-a-stick for?
Subinterfaces with 802.1Q tags on one trunk cable.
Why transport input ssh?
SSH is encrypted; Telnet shows everything you type to anyone capturing traffic.
Quick review cards
Check Your Understanding
Why test after each stage instead of once at the end?
Because the fault can only be in the last step, so you find it in minutes. At the end twenty possibilities blur together.
Later the client wants VLAN 30 cameras to reach only a recording server in VLAN 10. What do you add?
An ACL on the camera subinterface: permit from 192.168.30.0/24 to the server's address only, deny the rest of 192.168.10.0/24, then permit or deny whatever else the cameras need.
What goes in the project README?
The request, the topology (a picture), the addressing table, the decisions and why, the test matrix, and what you would improve for a bigger office.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.