A fully simulated, production-grade enterprise network modelling a real company with two office locations, connected securely over the internet — complete with VoIP phones, DMZ servers, encrypted VPN tunnels, firewalls, and automated IP management.
- Project Overview
- Network Architecture
- VLANs and Switching
- IP Addressing and Routing
- DHCP — Automatic IP Assignment
- Network Security
- VPN — Virtual Private Network
- VoIP — IP Phone System
- Network Management & Monitoring
- Access Control Lists
- Device Configuration Quick Reference
- How to Use This Project
- Complete Technology Stack
DualCore Enterprise Network is a fully simulated, production-grade enterprise network built inside Cisco Packet Tracer. It models a real company that has two physical office locations — a Headquarters (HQ) and a Branch office — connected securely over the internet, with employees able to make phone calls, browse the web, receive email, and work remotely, all protected by firewalls and encryption.
Think of it like building the entire networking infrastructure of a mid-sized company from scratch — every cable, every router, every security rule — in a virtual lab.
What is Packet Tracer? Cisco Packet Tracer is a network simulation tool. Instead of buying expensive physical routers and switches, you build and test a complete network virtually. Everything in this project — 18+ devices — runs inside Packet Tracer exactly as it would on real Cisco hardware.
| Component | Count / Detail |
|---|---|
| Sites | 2 (HQ + Branch) |
| Firewalls (ASA) | 2 |
| Core Routers | 2 |
| Distribution Switches | 4 (DS1–DS4) |
| Access Switches | 8 (AS1–AS8) |
| VPN Gateway | 1 |
| VLANs | 5 (Data × 4 + Voice × 1) |
| IP Phone Extensions | 20 (1001–1010 HQ, 1101–1110 Branch) |
| DMZ Servers (HQ) | 4 (AD/DNS, Mail, Web, FTP) |
| Routing Protocol | OSPF Area 0 |
| Redundancy | HSRP on every VLAN gateway |
| VPN Types | Site-to-Site IPsec + Remote Access IPsec |
The network follows a classic three-tier hierarchical design — the industry standard for enterprise networks. Think of it like a pyramid: the top handles big decisions (routing between networks), the middle connects floors of a building together, and the bottom is where individual computers and phones plug in.
| Tier | Devices | Role |
|---|---|---|
| Core (Tier 1) | Core R1 (HQ), Core R2 (Branch) | Internet-facing, NAT, VoIP call control, OSPF routing core |
| Distribution (Tier 2) | DS1, DS2 (HQ) · DS3, DS4 (Branch) | Inter-VLAN routing, HSRP redundancy, OSPF, STP root |
| Access (Tier 3) | AS1–AS4 (HQ) · AS5–AS8 (Branch) | End-user connectivity, port security, DHCP snooping, ARP inspection |
The HQ is the primary site. It hosts all shared services (DNS, mail, web, FTP) in a DMZ zone protected by ASA-Fw1. Four access switches serve four departments, each in its own VLAN.
| VLAN | Network | Gateway (HSRP VIP) | Access Switch | Hosts |
|---|---|---|---|---|
| VLAN 10 | 172.16.10.0/23 | 172.16.10.3 | AS1 | ~510 |
| VLAN 20 | 172.16.14.0/23 | 172.16.14.3 | AS2 | ~510 |
| VLAN 30 | 172.16.12.0/23 | 172.16.12.3 | AS3 | ~510 |
| VLAN 40 | 172.16.16.0/25 | 172.16.16.3 | AS4 | ~126 |
| VLAN 150 (Voice) | 192.168.10.0/27 | 192.168.10.3 | All AS | ~30 phones |
The Branch mirrors the HQ structure at a smaller scale, with its own firewall (ASA-Fw2), core router (Core R2), and two pairs of distribution switches.
| VLAN | Network | Gateway (HSRP VIP) | Access Switch | Hosts |
|---|---|---|---|---|
| VLAN 10 | 172.17.10.0/24 | 172.17.10.3 | AS5 | ~254 |
| VLAN 20 | 172.17.11.0/25 | 172.17.11.3 | AS6 | ~126 |
| VLAN 30 | 172.17.11.128/26 | 172.17.11.133 | AS7 | ~62 |
| VLAN 40 | 172.17.11.192/27 | 172.17.11.195 | AS8 | ~30 |
| VLAN 150 (Voice) | 192.168.10.0/27 | 192.168.10.3 | All AS | ~30 phones |
A VLAN (Virtual Local Area Network) is a way to split one physical network into multiple isolated logical networks. Imagine a company with HR, Engineering, Sales, and Management departments. Without VLANs, all their traffic mixes together. With VLANs, each department is on its own isolated network — they cannot directly communicate without going through a router (which can apply security rules).
| VLAN ID | Name | Type | Purpose |
|---|---|---|---|
| 10 | Data Dept A | Data | Workstations, department A users |
| 20 | Data Dept B | Data | Workstations, department B users |
| 30 | Data Dept C | Data | Workstations, department C users |
| 40 | Management/IT | Data | IT staff, management, server access |
| 150 | Voice | Voice (VoIP) | IP phones only — dedicated, isolated from data |
Why separate Voice into its own VLAN? Voice traffic (phone calls) is extremely sensitive to delay. If a phone packet is stuck behind a large file download, you hear choppy audio. By putting voice on VLAN 150, we can apply QoS (Quality of Service) policies to always give voice traffic priority, ensuring crystal-clear calls.
VTP (VLAN Trunking Protocol) can automatically share VLAN configurations between switches. However, it carries a serious risk: a new switch with a higher revision number can wipe out all VLAN configs on every switch in the network. To prevent this, every switch is set to VTP Transparent mode — it ignores VTP updates and manages its own VLAN table independently.
vtp mode transparent
| Port Type | Used On | VLANs Carried | Config |
|---|---|---|---|
| Access | f0/1–f0/19 on AS switches | One data VLAN only | switchport mode access |
| Access (Voice) | f0/20–f0/21 on AS switches | Data + Voice VLAN 150 | switchport voice vlan 150 |
| Trunk (uplink) | g0/1, g0/2 AS → DS | Native data VLAN + 150 | switchport mode trunk |
| Trunk (DS ↔ DS) | Port-channel 1 (EtherChannel) | All VLANs 10,20,30,40,150 | switchport mode trunk |
EtherChannel bundles multiple physical links into one logical high-bandwidth link. LACP (Link Aggregation Control Protocol — IEEE 802.3ad) negotiates this bundle automatically.
DS1 and DS2 are connected with two physical Gigabit links bundled into Port-channel 1 — double the bandwidth (2 Gbps logical), and if one link fails, traffic continues on the other with zero downtime.
interface range g1/0/22-23
channel-group 1 mode active ! LACP active — initiates negotiation
!
interface po1
switchport mode trunk
switchport trunk allowed vlan 1,10,20,30,40,150
STP prevents network loops. Redundant paths between switches are necessary for failover, but without STP they would create broadcast storms. STP elects one switch as Root Bridge and blocks redundant paths, activating them only if the primary path fails.
STP root is deliberately tuned per-VLAN for load-balanced, predictable traffic:
| VLAN Group | STP Root Primary | STP Root Secondary |
|---|---|---|
| VLANs 10, 20 | DS1 (HQ) / DS3 (Branch) | DS2 (HQ) / DS4 (Branch) |
| VLANs 30, 40, 150 | DS2 (HQ) / DS4 (Branch) | DS1 (HQ) / DS3 (Branch) |
PortFast makes access ports come up immediately (skipping STP delays). BPDUGuard shuts down any access port that receives a STP BPDU — protecting against someone plugging a rogue switch into a user port.
| Block | Site | Usage |
|---|---|---|
| 172.16.0.0/11 | HQ (Site 1) | All HQ user VLANs, management, loopbacks |
| 172.17.0.0/12 | Branch (Site 2) | All Branch user VLANs, management |
| 172.16.16.128/25 | HQ DMZ + Core | DMZ servers, firewall interfaces, core links |
| 111.10.10.0/29 | Internet-facing HQ | Public IPs — HQ ASA outside interface |
| 90.100.1.0/30 | Internet-facing Branch | Public IPs — Branch ASA outside |
| 20.20.0.0/29 | VPN Gateway | Public IP of remote-access VPN gateway |
| 172.16.16.160/28 | VPN Clients | IP pool assigned to remote-access VPN users |
| 192.168.10.0/27 | VoIP (both sites) | DHCP pool for IP phones |
OSPF (Open Shortest Path First) is a dynamic routing protocol — it automatically discovers all paths in the network and finds the shortest/fastest route to every destination. Think of it like Google Maps for network traffic: it constantly recalculates if a link goes down.
All Layer 3 devices (DS1–DS4, Core R1, Core R2, both ASA firewalls) run OSPF Area 0 (the backbone area). Each device advertises its directly connected networks into OSPF, and all others learn those routes automatically.
| Device | OSPF Router-ID | Networks Advertised |
|---|---|---|
| DS1 | 172.16.0.3 | 172.16.10.0/23, 172.16.12.0/23, 192.168.10.0/27 |
| DS2 | 172.16.0.4 | 172.16.14.0/23, 172.16.16.0/25, 192.168.10.0/27 |
| Core R1 | 172.16.0.2 | 172.16.16.128/25 (DMZ/core links) |
| ASA-Fw1 | 172.16.0.1 | 172.16.16.144/29, default route to internet |
| DS3 | 172.17.0.3 | 172.17.10.0/24, 172.17.11.0/25, 192.168.10.0/27 |
| DS4 | 172.17.0.4 | 172.17.11.128/26, 172.17.11.192/27 |
| Core R2 | 172.17.0.2 | 172.17.11.224/28 (core links) |
| ASA-Fw2 | 172.17.0.1 | 172.17.11.232/29, default route to internet |
HSRP gives every VLAN a virtual IP gateway that never goes down, even if one of the two distribution switches fails.
Analogy: Two pilots in a cockpit. Only one flies at a time (Active), but the other is always ready to take over instantly (Standby). End users are configured to use the virtual IP as their gateway — they never know which physical switch is actually forwarding their traffic.
| VLAN | HSRP VIP | Active (Priority 110) | Standby |
|---|---|---|---|
| 10 | 172.16.10.3 | DS1 | DS2 |
| 20 | 172.16.14.3 | DS1 | DS2 |
| 30 | 172.16.12.3 | DS2 | DS1 |
| 40 | 172.16.16.3 | DS2 | DS1 |
| 150 (Voice) | 192.168.10.3 | Both DS equal | — |
The preempt keyword ensures the primary switch automatically reclaims the Active role after recovering from a failure.
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices when they connect. Without it, a network admin would manually configure IP, subnet mask, gateway, and DNS on every single device — imagine doing that for 500 workstations.
DHCP is centralised: a single AD server in the DMZ (172.16.16.130) handles IP assignment for all data VLANs across both sites.
The challenge: DHCP uses broadcast messages that don't cross VLAN boundaries. The solution is ip helper-address — a relay agent that captures broadcasts on a VLAN and forwards them as unicast to the DHCP server.
| Device | VLAN | ip helper-address | DHCP Server |
|---|---|---|---|
| DS1 / DS2 | VLANs 10–40 (HQ) | 172.16.16.130 | DMZ AD server |
| DS3 | VLANs 10–40 (Branch) | 172.16.16.130 | Same server, via VPN |
| DS4 | VLANs 10–40 (Branch) | 111.10.10.3 (NAT'd) | Same server, via internet |
| DS1 / DS2 | VLAN 150 (Voice HQ) | 172.16.0.2 | Core R1 (local voice pool) |
| DS3 / DS4 | VLAN 150 (Voice Branch) | 172.17.0.2 | Core R2 (local voice pool) |
IP phones download their configuration from a TFTP server on power-on. DHCP Option 150 tells the phone the IP address of that TFTP server (the Core Router running CME).
ip dhcp pool voip-pool
network 192.168.10.0 255.255.255.224
default-router 192.168.10.3
option 150 ip 172.16.0.2 ! Points phone to Core R1 for config download
Security in this project is layered — like an onion. Even if one layer is bypassed, the next one stops the attack. This is called Defense in Depth, the gold standard in enterprise security.
A firewall decides what traffic is allowed through based on rules. Cisco ASA uses a security level model: interfaces are assigned a number 0–100. Higher-security zones can initiate connections to lower ones by default; lower-to-higher requires an explicit ACL rule.
| Firewall | Interface | Security Level | Connected To | IP Address |
|---|---|---|---|---|
| ASA-Fw1 (HQ) | inside (g1/1) | 100 | Core R1 internal | 172.16.16.146/29 |
| ASA-Fw1 (HQ) | dmz (g1/7) | 50 | DMZ server segment | 172.16.16.129/29 |
| ASA-Fw1 (HQ) | outside (g1/8) | 0 | Internet (ISP) | 111.10.10.2/29 |
| ASA-Fw2 (Branch) | inside (g1/1) | 100 | Core R2 internal | 172.17.11.234/29 |
| ASA-Fw2 (Branch) | outside (g1/8) | 0 | Internet (ISP) | 90.100.1.2/30 |
The DMZ is a special network zone between the internet and the internal network. Servers that need to be reachable from the internet are placed here. Even if an attacker compromises a DMZ server, they cannot reach internal users because the firewall blocks DMZ-to-inside traffic by default.
| Server | IP (DMZ) | Public NAT IP | Services Exposed |
|---|---|---|---|
| AD / DNS / DHCP | 172.16.16.130 | 111.10.10.3 | DNS (53), DHCP (67), NTP (123), TACACS+ (49) |
| Mail Server | 172.16.16.131 | 111.10.10.4 | SMTP (25), POP3 (110) |
| Web Server | 172.16.16.132 | 111.10.10.5 | HTTP (80), HTTPS (443) |
| FTP Server | 172.16.16.133 | — | FTP data (20), FTP control (21) |
NAT translates private IP addresses to public ones. It conserves public IPs and hides the internal network from the outside world.
| NAT Type | Device | How It Works | Example |
|---|---|---|---|
| PAT (Dynamic Overload) | Core R1 / Core R2 | Many-to-one: all internal users share one public IP, distinguished by port numbers | 1000 users all appear as 172.16.16.147:xxxxx |
| Static NAT | ASA-Fw1 | One-to-one: a private server IP is permanently mapped to a public IP | 172.16.16.132 always appears as 111.10.10.5 |
| Static NAT (VoIP) | Core R1 | VoIP gateway gets a fixed public address for H.323 call signaling | 172.16.16.145 for phone call routing |
Limits how many MAC addresses (device hardware IDs) can connect on one port. Sticky MAC learning locks the port to the first connected device.
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky ! Remember the connected device's MAC
switchport port-security violation restrict ! Drop extra traffic, log the violation
Prevents a rogue DHCP server attack. An attacker could plug in a fake DHCP server to route all user traffic through their machine (man-in-the-middle). DHCP Snooping marks only legitimate uplink ports as trusted — DHCP responses from untrusted ports are dropped.
ip dhcp snooping
ip dhcp snooping vlan 10
! Uplink ports to DS switches are marked: ip dhcp snooping trust
ARP has no authentication — anyone can send a fake ARP claiming "I am the default gateway." This is called ARP poisoning. DAI validates every ARP packet against the DHCP snooping binding table and drops forged ones.
ip arp inspection vlan 10
ip arp inspection validate src-mac dst-mac ip
Telnet sends passwords in plain text — anyone watching the network can read them. SSH encrypts the management session. All devices in this project are SSH-only, with VTY lines restricted by ACL to management subnet IPs only.
ip domain-name ccna10.com
crypto key generate rsa general-keys modulus 1024
!
line vty 0 15
transport input ssh ! Refuse Telnet
access-class 22 in ! Only allow IPs from ACL 22
A VPN creates an encrypted tunnel over the internet, making geographically separate networks act as if they are on the same private network. All data through the tunnel is encrypted — even if an attacker captures packets, they see only scrambled ciphertext.
This permanently connects HQ and Branch. Traffic between the two sites automatically enters the encrypted tunnel without any action from users.
Analogy: Think of the two sites like two bank branches in different cities. The Site-to-Site VPN is a private armoured underground tunnel between them. Data travels through it completely invisible to anything on the public internet.
IPsec negotiates the tunnel in two phases:
Phase 1 — IKE (Internet Key Exchange): Devices authenticate each other and agree on encryption parameters.
| Parameter | Value | Meaning |
|---|---|---|
| Encryption | AES (128-bit) | Advanced Encryption Standard — industry standard cipher |
| Authentication | Pre-Shared Key | Both firewalls share the same password: ccna10Pass |
| DH Group | Group 5 (1536-bit) | Diffie-Hellman key exchange strength |
| Protocol | IKEv1 | Version 1 of Internet Key Exchange |
Phase 2 — IPsec SA: Actual data encryption parameters are negotiated.
crypto ipsec ikev1 transform-set IPSEC-set esp-aes esp-sha-hmac
! esp-aes = AES encryption for the data payload
! esp-sha-hmac = SHA-1 for data integrity (detects tampering)
The tunnel connects ASA-Fw1 (111.10.10.2) ↔ ASA-Fw2 (90.100.1.2). Traffic between 172.16.0.0/11 (HQ) and 172.17.0.0/12 (Branch) is automatically encrypted.
Allows individual employees to connect securely from home as if physically in the office.
| Parameter | Value |
|---|---|
| Gateway Public IP | 20.20.0.6 |
| Encryption | AES-256 |
| DH Group | Group 2 |
| Client IP Pool | 172.16.16.161 – 172.16.16.170 (/28) |
| Authentication | TACACS+ first, then local (failover) |
| Group Name / Key | ccna10group / ccna10pass |
TACACS+ is an AAA protocol — Authentication (who are you?), Authorization (what are you allowed to do?), Accounting (what did you do?). The VPN Gateway sends login requests to the AD server to verify remote user credentials against the corporate directory.
aaa new-model
aaa authentication login ccna10Auth group tacacs+ local
tacacs-server host 111.10.10.3
tacacs-server key aaaPass
VoIP turns voice calls into data packets and sends them over the IP network — eliminating the need for a separate telephone system.
Cisco CME (CallManager Express) runs on the Core Routers and acts as a PBX — the brain of the phone system. It registers IP phones, assigns extensions, and routes calls.
| Site | Call Manager | CME IP (TFTP) | Extensions | Max Phones |
|---|---|---|---|---|
| HQ | Core R1 | 172.16.0.2 | 1001 – 1010 | 20 |
| Branch | Core R2 | 172.17.0.2 | 1101 – 1110 | 20 |
To call between sites, the Core Routers use H.323 dial-peers — rules that say "if the dialed number matches this pattern, send the call to this remote router."
! On Core R1 (HQ) — route calls to Branch extensions 11xx
dial-peer voice 10 voip
destination-pattern 11..
session target ipv4:172.17.11.233
! On Core R2 (Branch) — route calls to HQ extensions 10xx
dial-peer voice 11 voip
destination-pattern 10..
session target ipv4:172.16.16.145
VoIP call signaling travels through the Site-to-Site IPsec VPN tunnel — all inter-site calls are fully encrypted.
Voice calls are ruined by delay and packet loss. LLQ (Low Latency Queuing) with DSCP EF marking ensures voice packets always jump the queue ahead of regular data traffic.
class-map match-any voip-map
match access-group name voip-acl
policy-map voip-pol
class voip-map
priority percent 10 ! 10% guaranteed bandwidth, never drops
set ip dscp ef ! Mark with DSCP EF (46) — highest priority
interface f0/0
service-policy output voip-pol
Accurate timestamps on every device are critical — without them you cannot correlate events across devices during troubleshooting.
NTP uses a stratum hierarchy: Stratum 1 = atomic clock, Stratum 2 = server syncing from Stratum 1, etc. Core R2 is configured as ntp master 3 (an internal authoritative source).
| Device | NTP Source | Role |
|---|---|---|
| Core R1, Core R2 | 1.1.1.1 (Cloudflare) | Internet NTP sync |
| Core R2 | Self (ntp master 3) |
Internal authoritative time server |
| AS1–AS4 (HQ) | 172.16.16.3 | Sync from local DS switch |
| AS5–AS8 (Branch) | 172.17.11.195 | Sync from local DS switch |
| ASA-Fw1 | 172.16.0.2 (Core R1) | Sync from HQ core |
| ASA-Fw2 | 172.17.0.2 (Core R2) | Sync from Branch core |
Syslog collects log messages from all devices and sends them to a central server. Instead of logging into 18 devices one by one, a network admin sees all messages in one place in real time.
| Site | Syslog Server | All Devices Send Logs Here |
|---|---|---|
| HQ | 172.16.16.5 | All HQ routers, switches, firewalls |
| Branch | 172.17.11.197 | All Branch routers, switches, firewalls |
logging host 172.16.16.5
service timestamps log datetime msec ! Millisecond-precision timestamps
DNS (Domain Name System) translates hostnames to IP addresses. The AD server (172.16.16.130) handles recursive DNS — when it doesn't know an answer, it queries upstream public DNS servers. All devices use ccna10.com as the internal domain name.
ACLs are ordered lists of permit/deny rules that filter traffic. Rules are checked top-to-bottom; the first match wins. There is always an implicit deny all at the end — anything not explicitly permitted is dropped.
| ACL Name | Applied To | Key Permitted Traffic |
|---|---|---|
from-dmz |
DMZ interface inbound | DNS/DHCP/NTP from AD server; HTTP/HTTPS from web server; SMTP/POP3 from mail server; FTP from FTP server |
from-outside |
Outside interface inbound | DNS to AD server; SMTP/POP3/HTTPS to mail/web servers; IPsec/VPN traffic; SSH from specific admin IPs only |
Key rules in the nat-acl on Core R1:
- Allow syslog server (172.16.16.5) to SSH to ASA-Fw2 for remote management
- Deny internal users (172.16.10.0/21) from reaching VPN gateway or DMZ management IPs
- Deny cross-site routing through NAT — inter-site traffic goes through the VPN tunnel
- Permit all other internal traffic to be NAT'd to the internet via PAT overload
| Setting | Value | Command |
|---|---|---|
| Enable Password | adm (switches) / root (routers) | enable secret <password> |
| Console Password | adm | line console 0 → password adm |
| Domain Name | ccna10.com | ip domain-name ccna10.com |
| SSH Key | RSA 1024-bit | crypto key generate rsa general-keys modulus 1024 |
| SSH User | adm / adm | username adm secret adm |
| VTY Transport | SSH only | transport input ssh |
| Exec Timeout | 30 minutes | exec-timeout 30 |
| Log Timestamps | Enabled (msec) | service timestamps log datetime msec |
| DNS Lookup | Disabled | no ip domain lookup |
| Switch | Site | Data VLAN | Mgmt IP | Notes |
|---|---|---|---|---|
| AS1 | HQ | 10 | 172.16.10.4/23 | Port-sec max 1, DHCP snoop, DAI VLAN 10 |
| AS2 | HQ | 20 | 172.16.14.4/23 | Port-sec max 1, DHCP snoop, DAI VLAN 20 |
| AS3 | HQ | 30 | 172.16.12.4/23 | STP VLAN 150 cost 100 on g0/1 |
| AS4 | HQ | 40 | 172.16.16.4/25 | f0/22 trunk port for special device |
| AS5 | Branch | 10 | 172.17.10.4/24 | ACL 22 allows both sites' mgmt subnets |
| AS6 | Branch | 20 | 172.17.11.4/25 | Port-sec max 3 on voice ports (f0/20–21) |
| AS7 | Branch | 30 | 172.17.11.134/26 | STP VLAN 150 cost 100 on g0/1 |
| AS8 | Branch | 40 | 172.17.11.196/27 | f0/22 as VLAN 150 access port |
- Cisco Packet Tracer 8.0 or later — free download from netacad.com
- A computer with at least 4 GB RAM (8 GB recommended)
- Optional: Cisco NetAcad account for full Packet Tracer features
- Download and install Cisco Packet Tracer from netacad.com
- Open Packet Tracer → File → Open
- Navigate to the
project/folder and openccna10.pkt - Wait for the network to fully initialise — all link lights turn green (30–60 seconds)
- Device configs are in
project/configs/for reference or re-application
| Test | How to Test | Expected Result |
|---|---|---|
| VLAN isolation | Ping from VLAN 10 PC to VLAN 20 PC | Success (routed through DS via OSPF) |
| Internet access | Ping from any PC to 111.10.10.x | Success (via NAT/PAT) |
| VoIP call HQ → Branch | Dial 1101 from extension 1001 | Call connects across VPN tunnel |
| Remote SSH | SSH to any switch from management IP | Login with adm / adm |
| VPN connectivity | Ping 172.16.x from 172.17.x | Success via IPsec tunnel |
| Web server access | HTTP to 111.10.10.5 from outside | Web page loads (static NAT) |
| Command | What It Shows |
|---|---|
show ip ospf neighbor |
OSPF neighbors — should show Full state |
show standby brief |
HSRP status — Active/Standby per VLAN |
show etherchannel summary |
EtherChannel — P (in-bundle) for both links |
show port-security interface <int> |
Port security violations, secure MACs |
show ip dhcp binding |
Current DHCP leases — IP to MAC mappings |
show crypto isakmp sa |
IPsec Phase 1 — QM_IDLE = tunnel up |
show crypto ipsec sa |
IPsec Phase 2 — packet counters confirm traffic |
show vlan brief |
VLAN table — all VLANs and assigned ports |
| Category | Technology / Protocol | Purpose |
|---|---|---|
| Switching | VLANs (802.1Q) | Network segmentation into logical groups |
| Switching | VTP Transparent | Safe independent VLAN management per switch |
| Switching | STP / PortFast / BPDUGuard | Loop prevention, fast init, rogue switch blocking |
| Switching | LACP EtherChannel (802.3ad) | Link aggregation for redundancy and bandwidth |
| Routing | OSPF (Area 0) | Dynamic shortest-path routing across all L3 devices |
| Routing | HSRP | Gateway redundancy — zero-downtime failover |
| Addressing | DHCP + ip helper-address | Automated IP addressing with centralised relay |
| NAT | PAT (overload) | Many-to-one internet access |
| NAT | Static NAT | One-to-one public mapping for servers |
| Security | Cisco ASA Firewall | Stateful inspection, ACLs, NAT, VPN termination |
| Security | Port Security + Sticky MAC | Prevent unauthorized device connections |
| Security | DHCP Snooping | Block rogue DHCP servers |
| Security | Dynamic ARP Inspection | Block ARP poisoning / man-in-the-middle attacks |
| Security | SSH + RSA | Encrypted device management |
| VPN | IPsec Site-to-Site (IKEv1) | Encrypted inter-site connectivity |
| VPN | IPsec Remote Access | Encrypted remote worker connectivity |
| AAA | TACACS+ | Centralised authentication for VPN users |
| VoIP | Cisco CME (telephony-service) | Internal IP phone call control system |
| VoIP | H.323 dial-peer | Inter-site call routing protocol |
| QoS | LLQ + DSCP EF | Priority queuing and traffic marking for voice |
| Management | NTP | Network-wide clock synchronisation |
| Management | Syslog | Centralised event logging |
| Management | DNS (recursive) | Hostname resolution, internal and external |
DualCore Enterprise Network — Dual-Site Secure Enterprise Network* Built with Cisco Packet Tracer · Domain: ccna10.com · License: MIT