An enterprise network simulation for a fintech company with one headquarters and two regional branches. The project focuses on network segmentation, redundant gateways, resilient WAN paths, controlled inter-VLAN access, and repeatable validation in Cisco Packet Tracer.
Important
Implementation boundary: The sections presented describe the features available in Cisco Packet Tracer.
- Project Overview
- Overall Topology
- Architecture
- VLAN & IP Design
- Routing / WAN
- High Availability
- Security
- Testing
- Repository Structure
- Key Configurations
- Future Improvements
FastPay is modeled as a distributed financial-services company with its headquarters in Ho Chi Minh City and branches in Da Nang and Ha Noi. Each site has redundant edge routers and multilayer switches. The headquarters acts as the WAN hub and hosts the shared data server.
| Item | Scope |
|---|---|
| Project context | Network Design course (NT113.Q11), academic year 2025-2026 |
| Platform | Cisco Packet Tracer |
| Sites | Ho Chi Minh City headquarters, Da Nang branch, Ha Noi branch |
| Network devices | 6 edge routers, 6 multilayer switches, access switches, WLCs, and access points |
| LAN services | VLAN segmentation, inter-VLAN routing, DHCP relay, HSRP, PVST, and LACP |
| WAN services | Hub-and-spoke GRE, OSPF on site transit links, static tunnel routes, and NAT/PAT |
| Security controls | Inbound SVI ACLs, WAN egress ACLs, management VLANs, and address translation |
| Validation | DHCP, ACL behavior, Internet access, PAT, inter-site reachability, and failover scenarios |
- Primary Packet Tracer model
- Validation copy
- Network design report
- IP addressing plan
- Test plan and results
- Exported device configurations
The WAN uses a hub-and-spoke layout. HCM is the hub, while HN and DN connect as spokes. Each branch router has a tunnel to both HCM edge routers, producing eight GRE tunnels across the full topology.
Detailed site views:
The simulated campus follows a hierarchical design with WAN/core, distribution, and access roles.
| Layer | Packet Tracer components | Responsibility |
|---|---|---|
| WAN / Core | Two edge routers per site | Internet access, GRE tunnels, PAT, and connectivity to both distribution switches |
| Distribution | Two multilayer switches per site | SVIs, inter-VLAN routing, HSRP, OSPF, ACL enforcement, and Layer 2 path control |
| Access | Department access switches, WLC, and AP | User, server, and wireless attachment to the distribution pair |
Typical traffic path:
Client -> Access switch -> HSRP virtual gateway -> Multilayer switch
-> Edge router -> GRE tunnel or Internet -> Destination
The design uses separate devices and links at the gateway, distribution, and WAN edge. A single multilayer-switch or edge-router failure therefore leaves an alternate forwarding path in the model.
The addressing scheme uses the second octet to identify a site and the third octet to identify a business function. Clients use the HSRP virtual address ending in .1 as their default gateway. The two multilayer switches normally use .2 and .3 on each SVI.
| Function | HCM | DN | HN |
|---|---|---|---|
| Management | VLAN 110, 10.10.10.0/24 |
VLAN 210, 10.20.10.0/25 |
VLAN 310, 10.30.10.0/25 |
| Accounting | VLAN 120, 10.10.20.0/24 |
VLAN 220, 10.20.20.0/25 |
VLAN 320, 10.30.20.0/25 |
| Risk Management | VLAN 130, 10.10.30.0/24 |
VLAN 230, 10.20.30.0/25 |
VLAN 330, 10.30.30.0/25 |
| IT | VLAN 140, 10.10.40.0/24 |
VLAN 240, 10.20.40.0/25 |
VLAN 340, 10.30.40.0/25 |
| Local Servers | VLAN 150, 10.10.50.0/26 |
VLAN 250, 10.20.50.0/26 |
VLAN 350, 10.30.50.0/26 |
| Staff Wi-Fi | VLAN 160, 10.10.60.0/22 |
VLAN 260, 10.20.60.0/22 |
VLAN 360, 10.30.60.0/22 |
| Network Management | VLAN 199, 10.10.99.0/26 |
VLAN 299, 10.20.99.0/26 |
VLAN 399, 10.30.99.0/26 |
Additional conventions:
/30subnets connect each edge router to both multilayer switches.- HCM user VLANs use
/24; branch user VLANs use/25. - Server and network-management VLANs use
/26. - Staff Wi-Fi uses
/22for a larger client pool. ip helper-addressforwards client DHCP requests to the local DHCP server.
See the full IP addressing plan for transit networks, device addresses, DHCP pools, HSRP groups, tunnel addresses, and NAT pools.
- OSPF process 1 runs in area 0 between the multilayer switches and edge routers at each site.
- User-facing SVIs are passive OSPF interfaces. Only routed transit links form adjacencies.
- Each router has a default route toward the simulated ISP.
- Static routes send inter-site traffic through the GRE tunnel next hops.
| Tunnels | Path | Tunnel networks |
|---|---|---|
| 1, 2, 5, 6 | HCM to HN | 10.10.1.0/30, 10.10.2.0/30, 10.10.5.0/30, 10.10.6.0/30 |
| 3, 4, 7, 8 | HCM to DN | 10.10.3.0/30, 10.10.4.0/30, 10.10.7.0/30, 10.10.8.0/30 |
| Site | R1 public PAT pool | R2 public PAT pool |
|---|---|---|
| HCM | 203.113.6.35-39 |
203.113.6.51-55 |
| DN | 203.113.6.67-71 |
203.113.6.83-87 |
| HN | 203.113.6.3-7 |
203.113.6.19-23 |
The edge routers use overload PAT so multiple internal clients can share each public pool.
Note
The exported configurations prove GRE reachability. They do not contain IPsec configuration or show crypto ipsec sa evidence, so this repository does not claim encrypted site-to-site VPN as implemented.
| Mechanism | Implementation |
|---|---|
| Gateway redundancy | HSRP provides a virtual .1 gateway for every documented VLAN |
| Gateway load distribution | MS1 is preferred for business VLANs; MS2 is preferred for server, staff Wi-Fi, and management VLANs where configured |
| Distribution redundancy | Each access block connects to the multilayer-switch pair |
| Link redundancy | LACP EtherChannel joins the multilayer switches; PVST selects deterministic Layer 2 paths |
| WAN edge redundancy | Two edge routers and separate routed transit links exist at every site |
| Inter-site path redundancy | Each branch has four GRE paths to the two HCM routers |
| Internet translation | Each edge router owns a separate public PAT pool |
HSRP and single multilayer-switch failover are recorded as functional passes. Router and tunnel failover entries in the test document are marked PASS*: the alternate paths exist, but convergence time and packet loss still require a captured continuous-ping run. Existing PAT sessions can reset when traffic moves to the other edge router.
- Business functions, servers, staff Wi-Fi, and network management use separate VLANs and subnets.
- Named extended ACLs are applied inbound on user and staff Wi-Fi SVIs.
- The ACL policy blocks unnecessary lateral access between departments and protects the management subnet.
- Server access remains available where the policy permits it.
- Edge ACLs permit the modeled outbound HTTP, HTTPS, UDP, and ICMP traffic.
- NAT/PAT hides internal addressing from the simulated public network.
- Dedicated management VLANs separate infrastructure traffic from user networks.
The current controls implement network segmentation and Layer 3 filtering. They are not a Zero Trust deployment and do not include NAC, NGFW, IDS/IPS, WAF, or endpoint posture checks.
| Scenario | Expected behavior | Recorded result |
|---|---|---|
| HCM Accounting DHCP | Client receives a 10.10.20.0/24 lease and .1 gateway |
PASS |
| Accounting to IT | SVI ACL blocks VLAN 120 to VLAN 140 | PASS |
| Accounting to HCM data server | Allowed access to 10.10.50.40 |
PASS |
| Accounting to Internet | HTTP, HTTPS, DNS, and ICMP cross the edge | PASS |
| HCM PAT | Private sources translate into 203.113.6.35-39 |
PASS |
| HN to HCM data server | Branch client reaches 10.10.50.40 over GRE |
PASS |
| HSRP failover | Standby switch takes over the virtual gateway | PASS |
| Single multilayer-switch failure | Inter-site connectivity recovers | PASS |
| Single edge-router failure | Alternate router and tunnel path remains available | PASS* |
PASS* verifies the redundant design path, not a measured convergence target. The test plan lists the test conditions, expected outcomes, limitations, and verification commands.
Useful commands during a Packet Tracer demonstration:
show standby brief
show ip ospf neighbor
show ip route
show interfaces tunnel 1
show access-lists
show ip nat translations
show ip nat statistics
FastPay Network Design/
|-- configs/
| |-- hcm/ # HCM multilayer-switch and router configs
| |-- dn/ # DN multilayer-switch and router configs
| `-- hn/ # HN multilayer-switch and router configs
|-- docs/
| |-- FastPay Network Design Report.pdf
| |-- ip-addressing.md
| `-- testing.md
|-- images/
| |-- overall-topogy.png
| |-- hcm-topogy.png
| |-- dn-topogy.png
| `-- hn-topogy.png
|-- packet trancer/
| |-- FastPay Network Final.pkt
| `-- FastPay Network Final - Testing.pkt
`-- README.md
| Site | Multilayer switches | Edge routers |
|---|---|---|
| HCM | HCM-MS1, HCM-MS2 | HCM-R1, HCM-R2 |
| DN | DN-MS1, DN-MS2 | DN-R1, DN-R2 |
| HN | HN-MS1, HN-MS2 | HN-R1, HN-R2 |
Representative configuration patterns:
! Redundant default gateway
interface Vlan120
ip address 10.10.20.2 255.255.255.0
ip helper-address 10.10.50.30
ip access-group ACL_KeToan in
standby 20 ip 10.10.20.1
standby 20 priority 110
standby 20 preempt
! Site routing
router ospf 1
passive-interface default
no passive-interface GigabitEthernet1/0/23
network 10.10.90.0 0.0.0.3 area 0
! Hub-to-branch GRE path
interface Tunnel1
ip address 10.10.1.1 255.255.255.252
tunnel source Serial0/0/0
tunnel destination 203.113.6.2
! Internet address translation
ip nat pool MYPOOL 203.113.6.35 203.113.6.39 netmask 255.255.255.240
ip nat inside source list 10 pool MYPOOL overload