! ==========================================================
! MAG212 CYBER Campus Lab - Nimbus Coffee HQ (fictional)
! Device: NB-ACC3  (access, Catalyst 2960-24TT)
! Paste in Packet Tracer: CLI tab > enable > configure terminal (then this file)
! Tested in Packet Tracer 9.0 on macOS (Nov 2026). PT notes are marked "PT:".
! LAB ONLY: change every password before using ideas from this lab anywhere real.
! ==========================================================
! PT: stop log messages from cutting into pasted lines (turn back on with "logging console")
no logging console
hostname NB-ACC3
no ip domain-lookup
ip domain-name nimbus.lab
service password-encryption
service timestamps log datetime msec
enable secret M212-Enable-ChangeMe!
username netadmin privilege 15 secret M212-Lab-ChangeMe!
vtp mode transparent
banner motd ^Authorized access only. Activity on this device is logged.^
!
vlan 120
 name FINANCE
vlan 130
 name PRINTERS
vlan 199
 name MGMT
vlan 998
 name NATIVE-UNUSED
vlan 999
 name PARKING
!
spanning-tree mode rapid-pvst
!
ip dhcp snooping
ip dhcp snooping vlan 120
no ip dhcp snooping information option
ip arp inspection vlan 120
!
interface GigabitEthernet0/1
 description Uplink to NB-CORE1 GigabitEthernet1/0/4
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 120,130,199
 ip dhcp snooping trust
 ip arp inspection trust
 no shutdown
!
interface GigabitEthernet0/2
 description Uplink to NB-CORE2 GigabitEthernet1/0/4
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 998
 switchport trunk allowed vlan 120,130,199
 ip dhcp snooping trust
 ip arp inspection trust
 no shutdown
!
interface FastEthernet0/1
 description PC-FIN2 (FINANCE)
 switchport mode access
 switchport access vlan 120
 switchport nonegotiate
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
 spanning-tree portfast
 spanning-tree bpduguard enable
 ip dhcp snooping limit rate 10
 no shutdown
!
interface FastEthernet0/2
 description PRN-1 (PRINTERS)
 switchport mode access
 switchport access vlan 130
 switchport nonegotiate
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
interface range FastEthernet0/3 - 24
 description UNUSED - parked and shut
 switchport mode access
 switchport access vlan 999
 shutdown
!
interface Vlan1
 shutdown
!
interface Vlan199
 description Management
 ip address 10.212.199.13 255.255.255.224
 no shutdown
!
ip default-gateway 10.212.199.1
!
! SSH needs a hostname, a domain name and an RSA key before SSH version 2 can be enabled.
! RE-PASTING? If this device already has a key, delete the next line first, or IOS asks
! "replace? [yes/no]" and swallows the following line as the answer.
crypto key generate rsa general-keys modulus 2048
!
ip access-list standard VTY_MGMT
 remark Only the management VLAN may SSH to network devices
 permit 10.212.199.0 0.0.0.31
 deny any
!
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line con 0
 login local
 exec-timeout 10 0
 logging synchronous
line vty 0 15
 login local
 transport input ssh
 access-class VTY_MGMT in
 exec-timeout 10 0
!
logging host 10.212.150.10
ntp server 10.212.150.10
!
end
write memory
