Build a segmented small business network in Cisco Packet Tracer

Goal and scope

Build a small business network in Cisco Packet Tracer without physical hardware. The project moves from basic VLAN connectivity to a guest segment that receives DHCP, resolves an external lab name, and accesses one external HTTP service through PAT while internal user and server networks remain blocked.

This is a simulation, not a production firewall design or proof of production performance. The example addresses are synthetic. The WAN and external service use documentation address space; they do not provide real Internet connectivity. The configuration was built incrementally in eight lab exercises. The observations below were reported from those exercises; no .pkt project file or screenshots are attached.

Topology

PC-USER       192.168.10.21 (DHCP)  VLAN 10  Fa0/1
PC-SERVER     192.168.20.10 (static) VLAN 20  Fa0/2
SERVER-INT    192.168.20.20 (static) VLAN 20  Fa0/4  DNS + HTTP
PC-GUEST      192.168.30.21 (DHCP)  VLAN 30  Fa0/3
                         |
                    SW1 (2960)
                    Gi0/1 trunk
                         |
                   R1 Gi0/0 (2911)
                   802.1Q subinterfaces
                   R1 Gi0/1: 203.0.113.2/30
                         |
                   ISP Gi0/0: 203.0.113.1/30
                   ISP Gi0/1: 198.51.100.1/24
                         |
                   SERVER-EXT: 198.51.100.10/24
                   DNS + HTTP: portal.test

Prerequisites

Install Cisco Packet Tracer and add two 2911 routers, one 2960 switch, three PCs and two Server-PT devices. Wire the ports as shown. The server in VLAN 20 uses 192.168.20.20/24 with gateway 192.168.20.1; the external server uses 198.51.100.10/24 with gateway 198.51.100.1. Configure the server addresses under Desktop > IP Configuration. Save a copy before each major change so a failed configuration can be rolled back.

1. VLANs and trunk on SW1

enable
configure terminal
vlan 10
 name USERS
vlan 20
 name SERVERS
vlan 30
 name GUEST
interface fastEthernet0/1
 switchport mode access
 switchport access vlan 10
interface fastEthernet0/2
 switchport mode access
 switchport access vlan 20
interface fastEthernet0/3
 switchport mode access
 switchport access vlan 30
interface fastEthernet0/4
 switchport mode access
 switchport access vlan 20
interface gigabitEthernet0/1
 switchport mode trunk
end
write memory

show vlan brief should list Fa0/1 in VLAN 10, Fa0/2 and Fa0/4 in VLAN 20, and Fa0/3 in VLAN 30. show interfaces trunk should show Gi0/1 trunking with VLANs 10, 20 and 30 active and forwarding. Run show commands from Switch#; from a configuration prompt, use end or do show ....

2. Router-on-a-stick on R1

enable
configure terminal
interface gigabitEthernet0/0
 no shutdown
interface gigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
interface gigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
end
write memory

Each subinterface is the gateway for one VLAN. Verify with show ip interface brief. At this initial stage, inter-VLAN routing is open; the guest policy is added later.

3. DHCP for users and guests

Keep the servers on static addresses. On R1:

configure terminal
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp excluded-address 192.168.30.1 192.168.30.20
ip dhcp pool USERS
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.20.20
ip dhcp pool GUEST
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.1
 dns-server 198.51.100.10
end
write memory

Select Desktop > IP Configuration > DHCP on PC-USER and PC-GUEST. The observed leases were 192.168.10.21 and 192.168.30.21. Check the clients' actual addresses with ipconfig and compare them with show ip dhcp binding. An old binding may remain after a client changes VLAN; the binding table alone does not identify the address currently configured on the PC.

4. Internal and external DNS/HTTP

On SERVER-INT, enable Services > DNS and create an A record ikw.test → 192.168.20.20; enable Services > HTTP. On SERVER-EXT, create portal.test → 198.51.100.10 and enable HTTP. These names exist only inside the lab.

After the WAN and NAT steps below, PC-USER should open http://ikw.test. PC-GUEST should open http://portal.test but fail to reach http://192.168.20.20.

5. Simulated ISP and default route

On R1:

configure terminal
interface gigabitEthernet0/1
 ip address 203.0.113.2 255.255.255.252
 no shutdown
exit
ip route 0.0.0.0 0.0.0.0 203.0.113.1
end
write memory

On ISP:

enable
configure terminal
interface gigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.252
 no shutdown
interface gigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 no shutdown
end
write memory

From R1, ping 203.0.113.1 and ping 198.51.100.10 should work before adding NAT. If R1 cannot reach SERVER-EXT, check the ISP interface, server IP, gateway and cable first. In the observed lab, the WAN gateway responded 5/5, while the external server initially returned unreachable because of a configuration mistake; that underlying connectivity was corrected before NAT.

6. PAT on R1

The following standard ACL selects which source networks are translated. It is not the guest security policy.

configure terminal
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 1 permit 192.168.30.0 0.0.0.255
interface gigabitEthernet0/0.10
 ip nat inside
interface gigabitEthernet0/0.20
 ip nat inside
interface gigabitEthernet0/0.30
 ip nat inside
interface gigabitEthernet0/1
 ip nat outside
ip nat inside source list 1 interface gigabitEthernet0/1 overload
end
write memory

Test http://198.51.100.10 from PC-USER and PC-GUEST, then inspect:

show ip nat translations
show ip nat statistics

The observed table mapped both 192.168.10.21 and 192.168.30.21 to inside-global 203.0.113.2 for ICMP and TCP/80 sessions. PAT distinguished sessions using translated ports or ICMP identifiers. Translation counts can change between consecutive commands as short-lived entries expire; Misses is not itself evidence of packet loss.

7. Minimum-access guest policy

Earlier exercises first denied GUEST to SERVERS, then also to USERS. The final lab replaced those rules with one inbound ACL. Apply only this final policy when building directly from this guide:

configure terminal
ip access-list extended GUEST_MINIMUM_ACCESS
 permit udp any eq 68 any eq 67
 permit udp 192.168.30.0 0.0.0.255 host 198.51.100.10 eq 53
 permit tcp 192.168.30.0 0.0.0.255 host 198.51.100.10 eq 53
 permit tcp 192.168.30.0 0.0.0.255 host 198.51.100.10 eq 80
 deny ip any any
exit
interface gigabitEthernet0/0.30
 ip access-group GUEST_MINIMUM_ACCESS in
end
write memory

The first line admits DHCP requests even before a client has a guest-subnet address. DNS can use UDP or TCP port 53; this test exercised UDP. HTTP to the external lab host uses TCP port 80. The final deny blocks access to internal VLANs and all other destinations. This is a deliberately narrow lab policy, not a general guest Internet rule: it does not allow HTTPS, NTP, additional DNS servers or other real-world services.

Validation matrix

The reported final ACL counters were 3 DHCP matches, 2 UDP DNS matches, 5 TCP HTTP matches and 67 deny matches. Counters are cumulative and do not by themselves identify a specific client or request. The TCP DNS rule had no matches in the captured test, which is consistent with DNS using UDP.

Troubleshooting exercise: the wrong access VLAN

Moving Fa0/1 from VLAN 10 to VLAN 30 caused PC-USER to receive 192.168.30.22 after a DHCP renewal. show vlan brief showed Fa0/1 in VLAN 30 while show interfaces trunk showed the trunk working. Restoring Fa0/1 to VLAN 10 and renewing DHCP restored access to the internal site.

Read the focused wrong-access-VLAN troubleshooting case for the evidence, alternative hypotheses, correction and rollback.

Reset and limitations

Keep a saved Packet Tracer copy before each step. To undo the final guest restriction, remove ip access-group GUEST_MINIMUM_ACCESS in from GigabitEthernet0/0.30 in the isolated lab, or restore the saved project. Removing it temporarily opens inter-VLAN routing for GUEST, so this is not a production rollback instruction.

Packet Tracer approximates device behaviour. Real networks need an explicit egress policy, stateful firewall design, secure management access, accurate vendor and version support checks, and tests for DNS, HTTPS, time, updates and application dependencies. No physical equipment or production network was used for this project.