🌐 Enterprise Network Infrastructure: Packet Tracer Project Documentation

This repository contains the full logical design, network topology, and device configurations for a corporate multi-VLAN network simulated inside Cisco Packet Tracer. The architecture implements secure remote access, automated IP allocation, high-availability link aggregation, and resilient spanning-tree path selection.

---

🗺️ Network Topology Overview

The infrastructure connects three primary departments across a Router-on-a-Stick (RoaS) topology:

Department / VLAN	Subnet Range	Default Gateway	Primary Switch Assignment
VLAN 2: Engineering (Eng)	192.168.1.0/24	192.168.1.1	Left_Switch
VLAN 3: Finance (Fin)	192.168.2.0/24	192.168.2.1	Right_Switch
VLAN 4: Information Technology (IT)	192.168.3.0/24	192.168.3.1	Both Switches / Server Pool

---

🛠️ How the Configurations Work

1. 🛡️ Router Security & Secure Shell (SSH)

• Local Authentication: A local user database is established with the username admin and an encrypted password (calm).
• Cryptographic Keys: A 3000-bit RSA key pair (://admin.com) encrypts all administrative traffic across the network.
• VTY Management Restriction: Standard Access List 1 permits traffic from the IT network (192.168.3.0/24). This is actively bound to virtual teletype lines (line vty 0 15) with the access-class 1 in command, ensuring only users within the IT department can establish an SSH connection.
• Session Security: Lines are forced to use SSH exclusively (transport input ssh), dropping unencrypted Telnet connections. An inactivity timer of 5 minutes prevents idle terminal exposures.

2. 📇 Automated IP Allocation (DHCP)

The core router (r1) acts as the central DHCP server for the corporate ecosystem:

• Address Exclusions: The ranges 192.168.1.1 to 192.168.1.5 and 192.168.2.1 to 192.168.2.5 are withheld from dynamic allocation. This reserves static IPs for gateways, switches, and network printers.
• Dynamic Scopes: Three address pools (Engi, Fin, IT) lease dynamic IP parameters to endpoint workstations, automatically passing down default gateway addresses and pointing traffic to the central DNS Server at 192.168.3.6.

3. 🌐 Inter-VLAN Routing (Router-on-a-Stick)

Physical interface Gig0/0 on the router acts as an 802.1Q trunk gateway:

• The interface is divided into virtual logical sub-interfaces (gig0/0.2, gig0/0.3, and gig0/0.4).
• Each sub-interface terminates a specific VLAN tag (dot1Q 2, dot1Q 3, dot1Q 4) and binds it to its corresponding subnet gateway IP. This setup allows hosts across separate VLANs to route packets through the router layer.

4. 🎛️ Switching, VTP, & EtherChannel

• VLAN Trunking Protocol (VTP): Mainswitch is established as the central VTP Server under the domain name flame. This server dynamically propagates the global VLAN database down to client switches across trunk connections.
• EtherChannel Link Aggregation:
  • Channel Group 1: Bundles links Fa0/2 and Fa0/3 between Mainswitch (Active) and Left_Switch (Passive).
  • Channel Group 2: Bundles links Fa0/4 and Fa0/5 between Mainswitch (Active) and Right_Switch (Passive).
  • This grouping bundles available trunk bandwidth and protects against single physical link failures.

5. 🔄 Spanning Tree Protocol (STP) & Edge Security

• Rapid PVST+: The network uses Rapid Per-VLAN Spanning Tree Plus (rapid-pvst) to ensure rapid convergence during link topology changes.
• Root Bridge Optimization:
  • Mainswitch is declared the primary root bridge for VLAN 2 and VLAN 3, forcing data paths to flow through the high-capacity core.
  • Mainswitch is the secondary backup root bridge for VLAN 4.
• Edge Port Fastening: End-user access ports (Engineering on Left_Switch fa0/3-4, Finance on Right_Switch fa0/3-4, and IT hosts) utilize spanning-tree portfast to bypass forwarding delays and bring workstations online immediately.
• BPDU Guard Protection: Access ports are protected with bpduguard enable. If an unauthorized switch is plugged into an edge port, the port goes down automatically to stop loop exploits.