{"id":3979,"date":"2026-11-05T13:19:45","date_gmt":"2026-11-05T21:19:45","guid":{"rendered":"https:\/\/cyber.mag212.com\/?page_id=3979"},"modified":"2026-11-05T18:10:37","modified_gmt":"2026-11-06T02:10:37","slug":"secure-campus-network-lab","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/secure-campus-network-lab\/","title":{"rendered":"Build and Secure an Enterprise Campus Network (Free Lab)"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-campus-lab\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style><style>.m212x details{background:var(--panel2);border:1px solid var(--line);border-radius:10px;padding:10px 14px;margin:8px 0}.m212x details summary{cursor:pointer}.m212x details p{margin-top:8px;color:var(--mute)}.m212x .sec h4{margin:16px 0 6px}.m212x table{display:block;overflow-x:auto}<\/style>\n<section class=\"hero\">\n<div class=\"kick\">MAG212 CYBER \u00b7 Learn \u00b7 Networking \u00b7 Lab 5<\/div>\n<h2>Design, build and secure <span>an enterprise campus network.<\/span><\/h2>\n<p>In this free project you build the headquarters network for Nimbus Coffee Co., a fictional company, from an empty Packet Tracer canvas. You plan the VLANs and addresses, connect an edge router, two core switches and four access switches, add redundancy so one failure does not take the office down, and then lock it down the way a security team expects. Everything runs on your own Mac or PC.<\/p>\n<div class=\"toc\">\n<a href=\"#topology\">The network<\/a>\n<a href=\"#design\">1 \u00b7 Design<\/a>\n<a href=\"#build\">2 \u00b7 Build<\/a>\n<a href=\"#configure\">3 \u00b7 Configure<\/a>\n<a href=\"#secure\">4 \u00b7 Secure<\/a>\n<a href=\"#verify\">5 \u00b7 Verify and break it<\/a>\n<a href=\"#download\">Download the lab<\/a>\n<a href=\"#quiz\">Check yourself<\/a>\n<\/div>\n<\/section>\n\n<section id=\"topology\" class=\"sec\">\n<h3>The network you will build<\/h3>\n<p><a href=\"\/wp-content\/uploads\/2026\/11\/nimbus-campus-topology.png\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/11\/nimbus-campus-topology.png\" alt=\"Nimbus Coffee HQ campus topology: ISP, NB-EDGE router, two core switches NB-CORE1 and NB-CORE2 joined by an EtherChannel, four access switches, a server and end devices in six VLANs\" style=\"width:100%;height:auto;border-radius:12px;border:1px solid var(--line)\" loading=\"lazy\"><\/a><\/p>\n<p class=\"small\">Original MAG212 CYBER design and artwork. Click to open full size. Level: intermediate (CCNA) \u00b7 Time: 3 to 4 hours \u00b7 Needs: Cisco Packet Tracer 9.0 (free) on macOS, Windows or Linux.<\/p>\n<\/section>\n\n<section id=\"design\" class=\"sec\">\n<h3>1 \u00b7 Design: decide before you click<\/h3>\n<p>Good networks are designed on paper first. Nimbus Coffee&#8217;s head office has staff, a finance team, shared printers, guest Wi-Fi visitors and a small server room. The requirements are:<\/p>\n<ul class=\"l\">\n<li><b>Separation:<\/b> each group in its own VLAN, so a problem or an attacker in one cannot easily reach the others.<\/li>\n<li><b>No single point of failure<\/b> between users and the Internet: two core switches, two uplinks per access switch, two routed links to the edge.<\/li>\n<li><b>Central addressing:<\/b> one DHCP server for every user VLAN.<\/li>\n<li><b>Least access:<\/b> guests get the Internet only; only staff and finance can print; only the management VLAN can log in to network devices.<\/li>\n<\/ul>\n<h4>The architecture: a two-tier &#8220;collapsed core&#8221;<\/h4>\n<p>Large campuses use three layers (access, distribution, core). A single building usually does not need a separate core, so the core and distribution roles are combined into one redundant pair of multilayer switches. That is what Nimbus HQ uses:<\/p>\n<ul class=\"l\">\n<li><b>Edge:<\/b> NB-EDGE connects to the provider, translates private addresses with NAT and gives the inside a default route.<\/li>\n<li><b>Core\/distribution:<\/b> NB-CORE1 and NB-CORE2 route between VLANs, act as the default gateways (with HSRP), and are the Spanning Tree roots.<\/li>\n<li><b>Access:<\/b> NB-ACC1 to ACC4 connect the users. This is where most security controls live.<\/li>\n<\/ul>\n<h4>The VLAN and IP plan<\/h4>\n<p>One simple rule makes the plan easy to remember and troubleshoot: <b>the third octet equals the VLAN ID<\/b>. VLAN 110 is 10.212.110.0, VLAN 140 is 10.212.140.0, and the gateway is always <code>.1<\/code>. Subnet sizes follow the need (VLSM): finance gets a \/26 (62 hosts), printers a \/27.<\/p>\n<table>\n<tr><th>VLAN<\/th><th>Name<\/th><th>Subnet<\/th><th>Gateway<\/th><th>Primary core<\/th><th>Addressing<\/th><\/tr>\n<tr><td><b>110<\/b><\/td><td>STAFF<\/td><td><code>10.212.110.0\/24<\/code><\/td><td><code>10.212.110.1<\/code><\/td><td>NB-CORE1<\/td><td>DHCP<\/td><\/tr><tr><td><b>120<\/b><\/td><td>FINANCE<\/td><td><code>10.212.120.0\/26<\/code><\/td><td><code>10.212.120.1<\/code><\/td><td>NB-CORE2<\/td><td>DHCP<\/td><\/tr><tr><td><b>130<\/b><\/td><td>PRINTERS<\/td><td><code>10.212.130.0\/27<\/code><\/td><td><code>10.212.130.1<\/code><\/td><td>NB-CORE1<\/td><td>Static<\/td><\/tr><tr><td><b>140<\/b><\/td><td>GUEST<\/td><td><code>10.212.140.0\/24<\/code><\/td><td><code>10.212.140.1<\/code><\/td><td>NB-CORE2<\/td><td>DHCP<\/td><\/tr><tr><td><b>150<\/b><\/td><td>SERVERS<\/td><td><code>10.212.150.0\/27<\/code><\/td><td><code>10.212.150.1<\/code><\/td><td>NB-CORE1<\/td><td>Static<\/td><\/tr><tr><td><b>199<\/b><\/td><td>MGMT<\/td><td><code>10.212.199.0\/27<\/code><\/td><td><code>10.212.199.1<\/code><\/td><td>NB-CORE1<\/td><td>Static<\/td><\/tr><tr><td><b>998<\/b><\/td><td>NATIVE-UNUSED<\/td><td colspan='4'>Native VLAN on every trunk. No hosts, no gateway.<\/td><\/tr><tr><td><b>999<\/b><\/td><td>PARKING<\/td><td colspan='4'>Every unused port lives here, shut down.<\/td><\/tr>\n<\/table>\n<p class=\"small\">Routed links: 10.212.0.0\/30 (EDGE\u2013CORE1) and 10.212.0.4\/30 (EDGE\u2013CORE2). Loopbacks 10.212.255.1 to .3. The ISP side uses 203.0.113.0\/30 and the &#8220;Internet&#8221; 198.51.100.0\/24, both reserved for documentation by RFC 5737.<\/p>\n<h4>Redundancy that actually works<\/h4>\n<p>Two core switches only help if they agree on who does what. Each VLAN has one <b>primary core<\/b> that is both the Spanning Tree root and the active HSRP gateway: NB-CORE1 for 110, 130, 150 and 199, NB-CORE2 for 120 and 140. Aligning them means traffic takes the shortest path and the load is shared. Each core watches its own uplink to the edge (HSRP tracking). If that link fails, its priority drops from 105 to 95, below its peer&#8217;s 100, and the other core takes over the gateway within seconds.<\/p>\n<\/section>\n\n<section id=\"build\" class=\"sec\">\n<h3>2 \u00b7 Build it in Packet Tracer<\/h3>\n<ol class=\"l\">\n<li><b>Install:<\/b> create a free Cisco Networking Academy account and download Packet Tracer 9.0. On Apple Silicon Macs it runs through Rosetta 2; if macOS blocks it, use System Settings \u2192 Privacy &amp; Security \u2192 Open Anyway.<\/li>\n<li><b>Place the devices:<\/b> two ISR4331 routers (ISP, NB-EDGE), two 3650-24PS (cores), four 2960-24TT (access), two Servers, six PCs, two Laptops and a Printer. Name each one as in the diagram.<\/li>\n<li><b>Cable:<\/b> use <i>Copper Straight-Through<\/i> and choose every port yourself, exactly as labelled in the diagram. The full cabling table is in the lab&#8217;s README.<\/li>\n<li><b>3650 tip:<\/b> if a 3650&#8217;s ports stay red, open its Physical tab and drag a power supply into the empty slot.<\/li>\n<li><b>NB-EDGE tip:<\/b> the ISR4331&#8217;s third port (Gi0\/0\/2) is an empty SFP slot. Before cabling, open NB-EDGE \u2192 Physical and drag a <b>GLC-TE<\/b> copper module into the GE 0\/0\/2 slot.<\/li>\n<\/ol>\n<\/section>\n\n<section id=\"configure\" class=\"sec\">\n<h3>3 \u00b7 Configure, one layer at a time<\/h3>\n<p>The download contains one complete config per device. Paste them in order (ISP, EDGE, CORE1, CORE2, then the access switches), but read each stage below first so you know what every block does.<\/p>\n<div class=\"callout\"><b>Tested in Packet Tracer 9.0 (macOS, 5 Nov 2026):<\/b> MAG212 built this exact lab and pasted every config. Verified working: all links, OSPF with MD5, HSRP roles as designed, the core EtherChannel, DHCP through relay and snooping, staff access to the server, printer and Internet (NAT), guest isolation (Internet yes, internal no), SSH only from the management VLAN (refused from STAFF), HSRP failover (pull NB-CORE1&#8217;s uplink and traffic moves to NB-CORE2, then back), port security (a third MAC address is blocked) and DHCP snooping (a rogue DHCP server on a guest port is ignored). Packet Tracer rejected two hardening options (<code>log<\/code> on ACL lines and <code>login quiet-mode<\/code>), so the configs leave them out; the README lists every fix we needed.<\/div>\n<h4>Stage 1: VLANs and trunks<\/h4>\n<p>Every switch learns the VLAN names. Trunks carry only the VLANs they need (here NB-ACC4 needs only GUEST and MGMT), use an unused native VLAN, and never negotiate.<\/p>\n<pre>vlan 140\n name GUEST\ninterface GigabitEthernet0\/1\n switchport mode trunk\n switchport nonegotiate\n switchport trunk native vlan 998\n switchport trunk allowed vlan 140,199<\/pre>\n<h4>Stage 2: EtherChannel between the cores<\/h4>\n<p>Two links between the cores are bundled with LACP into Port-channel1, so they act as one fast link and Spanning Tree does not block one of them.<\/p>\n<pre>interface Port-channel1\n switchport mode trunk\ninterface range GigabitEthernet1\/0\/23 - 24\n switchport mode trunk\n channel-group 1 mode active<\/pre>\n<p class=\"small\">In our Packet Tracer build the bundle first showed <code>Po1(SD)<\/code>. Removing and re-adding <code>channel-group 1 mode active<\/code> on both cores brought it up; afterwards save every device and use <i>Power Cycle Devices<\/i> once so all switches start with clean MAC tables.<\/p>\n<h4>Stage 3: Spanning Tree roots<\/h4>\n<p>On NB-CORE1 (NB-CORE2 is the mirror image):<\/p>\n<pre>spanning-tree mode rapid-pvst\nspanning-tree vlan 110,130,150,199 root primary\nspanning-tree vlan 120,140 root secondary<\/pre>\n<h4>Stage 4: Gateways with HSRP, plus DHCP relay<\/h4>\n<p>Each core has its own address in the VLAN (.2 and .3) and they share the virtual gateway <code>.1<\/code>. <code>ip helper-address<\/code> forwards DHCP requests to the server in VLAN 150.<\/p>\n<pre>interface Vlan110\n ip address 10.212.110.2 255.255.255.0\n standby version 2\n standby 110 ip 10.212.110.1\n standby 110 priority 105\n standby 110 preempt\n standby 110 track GigabitEthernet1\/0\/1\n ip helper-address 10.212.150.10<\/pre>\n<h4>Stage 5: Routing (OSPF) and Internet access (NAT)<\/h4>\n<p>The cores and the edge share routes with OSPF over authenticated links. The edge has a static default route to the ISP and advertises it inside with <code>default-information originate<\/code>. NAT overload lets every inside device share one public address.<\/p>\n<pre>router ospf 1\n router-id 10.212.255.1\n passive-interface default\n no passive-interface GigabitEthernet0\/0\/1\n no passive-interface GigabitEthernet0\/0\/2\n default-information originate\nip route 0.0.0.0 0.0.0.0 203.0.113.1\nip nat inside source list NAT_INSIDE interface GigabitEthernet0\/0\/0 overload<\/pre>\n<h4>Stage 6: The server and the hosts<\/h4>\n<p>NB-SRV1 is set up in Packet Tracer&#8217;s graphical Services tab: DHCP pools for STAFF, FINANCE and GUEST (each with the right gateway), DNS, NTP and Syslog. The README lists every value. Then set every PC and laptop to DHCP, and give PC-ADMIN and the printer their static addresses.<\/p>\n<\/section>\n\n<section id=\"secure\" class=\"sec\">\n<h3>4 \u00b7 Secure it: think like an attacker<\/h3>\n<p>Security is applied in layers. For each control, ask what attack it stops:<\/p>\n<table>\n<tr><th>Attack or risk<\/th><th>Control in this lab<\/th><th>Where<\/th><\/tr>\n<tr><td>Someone plugs into a spare wall port<\/td><td>Unused ports shut down and parked in VLAN 999<\/td><td>All switches<\/td><\/tr>\n<tr><td>A device pretends to be a switch (VLAN hopping, DTP)<\/td><td><code>switchport nonegotiate<\/code>, unused native VLAN 998, pruned trunks<\/td><td>All trunks<\/td><\/tr>\n<tr><td>A rogue switch tries to take over Spanning Tree<\/td><td>PortFast with BPDU guard on user ports, root guard on core downlinks<\/td><td>Access \/ core<\/td><\/tr>\n<tr><td>A laptop floods the switch with fake MAC addresses<\/td><td>Port security: maximum 2 MACs, sticky, violation restrict<\/td><td>Access ports<\/td><\/tr>\n<tr><td>A rogue DHCP server hands out a fake gateway<\/td><td>DHCP snooping: only the uplinks are trusted<\/td><td>Access switches<\/td><\/tr>\n<tr><td>ARP spoofing \/ man-in-the-middle<\/td><td>Dynamic ARP Inspection on the DHCP VLANs<\/td><td>Access switches<\/td><\/tr>\n<tr><td>A guest sends fake HSRP messages to become the gateway<\/td><td><code>GUEST_IN<\/code> accepts HSRP hellos only from the two real cores<\/td><td>Core, VLAN 140<\/td><\/tr>\n<tr><td>A guest reaches internal systems<\/td><td>ACL <code>GUEST_IN<\/code>: DHCP, DNS and the Internet only<\/td><td>Core, VLAN 140<\/td><\/tr>\n<tr><td>Anyone can reach the printers<\/td><td>ACL <code>PRINTERS_OUT<\/code>: staff and finance only<\/td><td>Core, VLAN 130<\/td><\/tr>\n<tr><td>Password guessing on network devices<\/td><td>SSH v2 only, local users, VTY ACL (MGMT VLAN only), timeouts; <code>login block-for<\/code> on the edge router<\/td><td>Every device<\/td><\/tr>\n<tr><td>A fake router injects routes<\/td><td>OSPF MD5 authentication; user VLANs passive<\/td><td>Edge and cores<\/td><\/tr>\n<tr><td>Spoofed private addresses from the Internet<\/td><td>ACL <code>WAN_IN<\/code> drops RFC 1918, loopback and other impossible sources<\/td><td>Edge WAN<\/td><\/tr>\n<tr><td>No evidence after an incident<\/td><td>Central syslog and NTP time on NB-SRV1, timestamps in logs<\/td><td>Every device<\/td><\/tr>\n<\/table>\n<h4>Know the limits of each control<\/h4>\n<ul class=\"l\">\n<li><b>Dynamic ARP Inspection<\/b> only trusts addresses it saw handed out by DHCP. That is why it is off on the printer and management VLANs (static addresses), and why you enable it <i>after<\/i> every PC has renewed its lease. A real network adds static bindings or ARP ACLs for fixed devices.<\/li>\n<li><b>WAN_IN is anti-spoofing, not a firewall.<\/b> It drops impossible source addresses. What really keeps the Internet out is NAT overload, which has no inbound mappings, plus the VTY ACL. A real edge adds a stateful firewall.<\/li>\n<li><b>PRINTERS_OUT filters traffic routed into VLAN 130.<\/b> It does not filter traffic the core switch sends itself (so a ping from a core still works), or traffic between devices inside VLAN 130. A production version would also allow only print ports (TCP 9100, 631, 515).<\/li>\n<li><b>Guests cannot ping even their own gateway<\/b>: GUEST_IN blocks every 10.x.x.x destination. That is expected, not a fault.<\/li>\n<li><b>HSRP in other VLANs<\/b> trusts the users in them. Real networks also add HSRP authentication.<\/li>\n<li><b>service password-encryption<\/b> only hides passwords from shoulder-surfing (weak type 7). The real protection is <code>secret<\/code>, which stores a hash.<\/li>\n<li><b>OSPF MD5<\/b> is what Packet Tracer supports. On modern equipment prefer the SHA-based options your platform offers.<\/li>\n<li><b>NB-SRV1 is a single point of failure.<\/b> It hangs off NB-CORE1 only: if that switch fails, new devices get no DHCP or DNS. Fixing it is the bonus exercise.<\/li>\n<\/ul>\n<div class=\"callout\"><b>Lab passwords:<\/b> the configs use published lab passwords so you can follow along. Never reuse them. On real devices use unique, long passwords, central AAA (TACACS+ or RADIUS) and multi-factor authentication.<\/div>\n<\/section>\n\n<section id=\"verify\" class=\"sec\">\n<h3>5 \u00b7 Verify, then try to break it<\/h3>\n<p>A network is only finished when you have proved it works and proved the security controls block what they should:<\/p>\n<ol class=\"l\">\n<li><code>show etherchannel summary<\/code> on a core: Port-channel1 is up with both links bundled.<\/li>\n<li><code>show standby brief<\/code>: NB-CORE1 is active for 110, 130, 150, 199 and NB-CORE2 for 120 and 140.<\/li>\n<li><code>show ip ospf neighbor<\/code> on NB-EDGE: two neighbours in FULL state.<\/li>\n<li>On PC-STAFF1: <code>ipconfig<\/code> shows a 10.212.110.x lease, and <code>http:\/\/web.internet.lab<\/code> opens in the web browser.<\/li>\n<li>From LAP-GUEST1: the web works, but a ping to any 10.212.x.x address fails, by design.<\/li>\n<li>From PC-ADMIN: <code>ssh -l netadmin 10.212.199.2<\/code> works. From PC-STAFF1 the same command is refused.<\/li>\n<li><b>Break it:<\/b> shut NB-CORE1&#8217;s uplink. Watch NB-CORE2 become the active gateway for every VLAN, and confirm PC-STAFF1 can still reach the web server.<\/li>\n<li><b>Attack it:<\/b> connect a rogue DHCP server to a spare port and renew a PC. It still gets its address from NB-SRV1, because DHCP snooping drops the rogue&#8217;s offers.<\/li>\n<li><b>Bonus:<\/b> remove the biggest single point of failure. Connect NB-SRV1 to both cores, or add a second server, and prove DHCP still works with NB-CORE1 switched off.<\/li>\n<\/ol>\n<p>The README has 13 tests with expected results, plus a troubleshooting section.<\/p>\n<\/section>\n\n<section id=\"download\" class=\"sec\">\n<h3>Download the lab<\/h3>\n<div class=\"callout\"><b>Download:<\/b> <a href=\"\/wp-content\/uploads\/2026\/11\/mag212-campus-lab-v3.zip\">mag212-campus-lab.zip<\/a> \u00b7 8 device configs, the IP plan (CSV), the diagram (SVG), a step-by-step README with cabling, server settings, tests and troubleshooting.<\/div>\n<p class=\"small\">Packet Tracer saves projects in its own .pkt format, which we do not distribute: building the network yourself is the exercise. All configs are for a simulator. Adapt and review them before using any idea on real equipment, and only work on networks you own or are authorised to manage.<\/p>\n<\/section>\n\n<section id=\"quiz\" class=\"sec\">\n<h3>Check yourself<\/h3>\n<details><summary><b>1.<\/b> Why is NB-CORE1 both the STP root and the HSRP active gateway for VLAN 110?<\/summary><p>So traffic from VLAN 110 goes straight up the forwarding uplink to the switch that routes it, with no extra hop across the core link. Misaligned roles still work, but waste bandwidth and confuse troubleshooting.<\/p><\/details>\n<details><summary><b>2.<\/b> What happens if NB-CORE1&#8217;s uplink to the edge fails?<\/summary><p>HSRP tracking lowers its priority from 105 to 95, below NB-CORE2&#8217;s 100. With preempt, NB-CORE2 becomes the active gateway and users keep working.<\/p><\/details>\n<details><summary><b>3.<\/b> Why is VLAN 998 used as the native VLAN?<\/summary><p>Untagged frames on a trunk fall into the native VLAN. Using an empty VLAN that no host uses removes a VLAN-hopping path (double tagging) and stops untagged traffic from landing in a real VLAN.<\/p><\/details>\n<details><summary><b>4.<\/b> Why are only the uplinks trusted for DHCP snooping?<\/summary><p>Real DHCP replies only ever arrive from the cores, which relay them from NB-SRV1. Any DHCP offer arriving on a user port must be a rogue server, so the switch drops it.<\/p><\/details>\n<details><summary><b>5.<\/b> Which device would you add next to remove the biggest single point of failure?<\/summary><p>A second server (or connecting NB-SRV1 to both cores). Today NB-SRV1 hangs off NB-CORE1 only. If that switch fails, new devices get no DHCP or DNS. The edge router and the ISP link are also single points of failure.<\/p><\/details>\n<\/section>\n\n<section class=\"sec\">\n<h3>Sources and further reading<\/h3>\n<ul class=\"l\">\n<li><a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/CVD\/Campus\/cisco-campus-lan-wlan-design-guide.html\" target=\"_blank\" rel=\"noopener\">Cisco Campus LAN and Wireless LAN Solution Design Guide<\/a><\/li>\n<li><a href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/access-lists\/13608-21.html\" target=\"_blank\" rel=\"noopener\">Cisco Guide to Harden Cisco IOS Devices<\/a><\/li>\n<li><a href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/dynamic-host-configuration-protocol-dhcp-dhcpv6\/217055-operate-and-troubleshoot-dhcp-snooping.html\" target=\"_blank\" rel=\"noopener\">Cisco: Operate and troubleshoot DHCP snooping<\/a><\/li>\n<li><a href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/switches\/lan-switch-software\/222274-troubleshoot-dynamic-arp-inspection-dai.html\" target=\"_blank\" rel=\"noopener\">Cisco: Troubleshoot Dynamic ARP Inspection and IP Source Guard<\/a><\/li>\n<li><a href=\"https:\/\/www.netacad.com\/cisco-packet-tracer\" target=\"_blank\" rel=\"noopener\">Cisco Packet Tracer (Networking Academy)<\/a><\/li>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc1918\" target=\"_blank\" rel=\"noopener\">RFC 1918: private addresses<\/a> \u00b7 <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc5737\" target=\"_blank\" rel=\"noopener\">RFC 5737: documentation addresses<\/a><\/li>\n<\/ul>\n<p class=\"small\">Original lab by MAG212 CYBER. The two-tier campus pattern itself is a standard industry design. Cisco, Catalyst and Packet Tracer are trademarks of Cisco Systems, Inc.; this lab is not affiliated with or endorsed by Cisco. More labs: <a href=\"\/learn\/labs\/\">Hands-on Labs<\/a>.<\/p>\n<\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Free Packet Tracer project: design, build and secure a two-tier enterprise campus network with VLANs, HSRP, OSPF, NAT, DHCP snooping, DAI and ACLs. Original MAG212 CYBER lab.<\/p>","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3979","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3979"}],"version-history":[{"count":4,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3979\/revisions"}],"predecessor-version":[{"id":3989,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3979\/revisions\/3989"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}