! ==========================================================
! MAG212 CYBER Campus Lab - Nimbus Coffee HQ (fictional)
! Device: NB-CORE1  (core/distribution, Catalyst 3650-24PS)
! Paste in Packet Tracer: CLI tab > enable > configure terminal (then this file)
! Tested in Packet Tracer 9.0 on macOS (Nov 2026). PT notes are marked "PT:".
! LAB ONLY: change every password before using ideas from this lab anywhere real.
! ==========================================================
! PT: stop log messages from cutting into pasted lines (turn back on with "logging console")
no logging console
hostname NB-CORE1
no ip domain-lookup
ip domain-name nimbus.lab
service password-encryption
service timestamps log datetime msec
enable secret M212-Enable-ChangeMe!
username netadmin privilege 15 secret M212-Lab-ChangeMe!
vtp mode transparent
banner motd ^Authorized access only. Activity on this device is logged.^
!
ip routing
!
vlan 110
 name STAFF
vlan 120
 name FINANCE
vlan 130
 name PRINTERS
vlan 140
 name GUEST
vlan 150
 name SERVERS
vlan 199
 name MGMT
vlan 998
 name NATIVE-UNUSED
vlan 999
 name PARKING
!
spanning-tree mode rapid-pvst
spanning-tree vlan 110,130,150,199 root primary
spanning-tree vlan 120,140 root secondary
!
interface GigabitEthernet1/0/1
 description Routed uplink to NB-EDGE
 no switchport
 ip address 10.212.0.2 255.255.255.252
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 M212-ospf-Key
 no shutdown
!
! PT: build Port-channel1 first, then add the member ports. If "show etherchannel summary"
! still shows Po1(SD) with (s) ports, run on BOTH cores: interface range Gi1/0/23 - 24 ,
! no channel-group 1 , channel-group 1 mode active  (this fixed it in our PT 9.0 test).
interface Port-channel1
 description Core-to-core trunk (LACP)
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 110,120,130,140,150,199
!
interface range GigabitEthernet1/0/23 - 24
 description EtherChannel to NB-CORE2
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 110,120,130,140,150,199
 channel-group 1 mode active
 no shutdown
!
interface GigabitEthernet1/0/2
 description Trunk to NB-ACC1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 110,199
 spanning-tree guard root
 no shutdown
!
interface GigabitEthernet1/0/3
 description Trunk to NB-ACC2
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 110,120,199
 spanning-tree guard root
 no shutdown
!
interface GigabitEthernet1/0/4
 description Trunk to NB-ACC3
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 120,130,199
 spanning-tree guard root
 no shutdown
!
interface GigabitEthernet1/0/5
 description Trunk to NB-ACC4
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 140,199
 spanning-tree guard root
 no shutdown
!
interface GigabitEthernet1/0/10
 description NB-SRV1 (DHCP DNS NTP Syslog)
 switchport mode access
 switchport access vlan 150
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
interface range GigabitEthernet1/0/6 - 9 , GigabitEthernet1/0/11 - 22
 description UNUSED - parked and shut
 switchport mode access
 switchport access vlan 999
 shutdown
!
interface range GigabitEthernet1/1/1 - 4
 description UNUSED SFP uplinks - parked and shut
 switchport mode access
 switchport access vlan 999
 shutdown
!
interface Vlan110
 description STAFF gateway
 ip address 10.212.110.2 255.255.255.0
 standby version 2
 standby 110 ip 10.212.110.1
 standby 110 priority 105
 standby 110 preempt
 standby 110 track GigabitEthernet1/0/1
 ip helper-address 10.212.150.10
 no shutdown
!
interface Vlan120
 description FINANCE gateway
 ip address 10.212.120.2 255.255.255.192
 standby version 2
 standby 120 ip 10.212.120.1
 standby 120 priority 100
 standby 120 preempt
 standby 120 track GigabitEthernet1/0/1
 ip helper-address 10.212.150.10
 no shutdown
!
interface Vlan130
 description PRINTERS gateway
 ip address 10.212.130.2 255.255.255.224
 standby version 2
 standby 130 ip 10.212.130.1
 standby 130 priority 105
 standby 130 preempt
 standby 130 track GigabitEthernet1/0/1
 ip access-group PRINTERS_OUT out
 no shutdown
!
interface Vlan140
 description GUEST gateway
 ip address 10.212.140.2 255.255.255.0
 standby version 2
 standby 140 ip 10.212.140.1
 standby 140 priority 100
 standby 140 preempt
 standby 140 track GigabitEthernet1/0/1
 ip helper-address 10.212.150.10
 ip access-group GUEST_IN in
 no shutdown
!
interface Vlan150
 description SERVERS gateway
 ip address 10.212.150.2 255.255.255.224
 standby version 2
 standby 150 ip 10.212.150.1
 standby 150 priority 105
 standby 150 preempt
 standby 150 track GigabitEthernet1/0/1
 no shutdown
!
interface Vlan199
 description MGMT gateway
 ip address 10.212.199.2 255.255.255.224
 standby version 2
 standby 199 ip 10.212.199.1
 standby 199 priority 105
 standby 199 preempt
 standby 199 track GigabitEthernet1/0/1
 no shutdown
!
interface Loopback0
 ip address 10.212.255.2 255.255.255.255
!
router ospf 1
 router-id 10.212.255.2
 passive-interface default
 no passive-interface GigabitEthernet1/0/1
 network 10.212.0.2 0.0.0.0 area 0
 network 10.212.255.2 0.0.0.0 area 0
 network 10.212.110.0 0.0.0.255 area 0
 network 10.212.120.0 0.0.0.63 area 0
 network 10.212.130.0 0.0.0.31 area 0
 network 10.212.140.0 0.0.0.255 area 0
 network 10.212.150.0 0.0.0.31 area 0
 network 10.212.199.0 0.0.0.31 area 0
!
ip access-list extended GUEST_IN
 remark Guests get DHCP, DNS and the Internet - nothing internal
 remark HSRP hellos only from the two real gateways, so a guest cannot hijack .1
 permit udp host 10.212.140.2 host 224.0.0.102 eq 1985
 permit udp host 10.212.140.3 host 224.0.0.102 eq 1985
 deny udp any any eq 1985
 permit udp any eq bootpc host 255.255.255.255 eq bootps
 permit udp 10.212.140.0 0.0.0.255 eq bootpc host 10.212.150.10 eq bootps
 permit udp 10.212.140.0 0.0.0.255 host 10.212.150.10 eq domain
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 0.15.255.255
 deny ip any 192.168.0.0 0.0.255.255
 permit ip any any
!
ip access-list extended PRINTERS_OUT
 remark Traffic routed INTO the printer VLAN: STAFF, FINANCE, MGMT, and replies from NB-SRV1
 remark (does not filter traffic the core itself sends, or traffic inside VLAN 130)
 permit ip 10.212.110.0 0.0.0.255 10.212.130.0 0.0.0.31
 permit ip 10.212.120.0 0.0.0.63 10.212.130.0 0.0.0.31
 permit ip 10.212.199.0 0.0.0.31 10.212.130.0 0.0.0.31
 permit ip host 10.212.150.10 10.212.130.0 0.0.0.31
 deny ip any any
!
! SSH needs a hostname, a domain name and an RSA key before SSH version 2 can be enabled.
! RE-PASTING? If this device already has a key, delete the next line first, or IOS asks
! "replace? [yes/no]" and swallows the following line as the answer.
crypto key generate rsa general-keys modulus 2048
!
ip access-list standard VTY_MGMT
 remark Only the management VLAN may SSH to network devices
 permit 10.212.199.0 0.0.0.31
 deny any
!
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line con 0
 login local
 exec-timeout 10 0
 logging synchronous
line vty 0 15
 login local
 transport input ssh
 access-class VTY_MGMT in
 exec-timeout 10 0
!
logging host 10.212.150.10
ntp server 10.212.150.10
!
end
write memory
