An end-to-end enterprise network architecture built with Cisco 1941 ISR Routers, Catalyst 2960 Switches, and Access Points. This project demonstrates multi-hop static routing, access control enforcement via Extended ACLs, and hybrid wired/wireless local site connectivity.
┌───────────────────────────────────────────────┐ ┌───────────────────────────────────────── ┐
│ LEFT SITE (LAN: 195.1.1.0/24) │ │ RIGHT SITE (LAN: 2.1.2.0/24) │
│ │ │ │
│ [MP Laptop] (195.1.1.253) │ │ [PC2] (2.1.2.2) │
│ │ Fa0/4 │ │ │ Fa0/1 │
│ [Left-SW]─── Gig0/0 ── [Left Router] │ │ [Right-SW]── Gig0/1 ── [Right Router] │
│ │ Fa0/3 │ Gig0/1 │ │ │ Fa0/2 │ Gig0/0 │
│ [AccessPoint0] │ (1.1.1.1) │ │ [PC3] (2.1.2.3) │ │
│ ├── Laptop0 (195.1.1.2) │ │ │ │ │
│ ├── Laptop1 (195.1.1.3) │ │ │ │ │
│ └── PC1 (195.1.1.4) │ │ │ │ │
└──────────────────────────────┼────────────────┘ └─────────────────────────────────┼────────┘
│ │
│ WAN LINK (2.1.1.0/24) │
└─── Gig0/0 ── [Middle Router] ── Gig0/1 ─────────────────────────────┘
(1.1.1.2) (2.1.1.1)
- ⚡ End-to-End IPv4 Convergence: Dynamic subnets routed seamlessly across three router hops (
Left,Middle,Right) using static default & gateway routes. - 🔒 Strict Access Control List (ACL):
- Permitted: Dedicated wired Management Laptop (
MP@195.1.1.253) has exclusive Telnet access (TCP Port 23) toRight-Router(2.1.1.2). - Blocked: All wireless end devices (
Laptop0,Laptop1,PC1) are blocked from initiating Telnet connections toRight-Router.
- Permitted: Dedicated wired Management Laptop (
- 📡 Secure Wi-Fi Integration: WPA2-PSK (AES) protected Access Point serving wireless corporate clients.
- 🩺 Full ICMP Diagnostic Support: ICMP Ping is allowed across all subnets for network monitoring.
| Device Name | Interface | IP Address | Subnet Mask | Default Gateway | Connection / Role |
|---|---|---|---|---|---|
| Left-Router | Gig0/0 |
195.1.1.254 |
255.255.255.0 |
N/A | Gateway for Left LAN (Left-SW) |
| Left-Router | Gig0/1 |
1.1.1.1 |
255.255.255.0 |
N/A | WAN Link to Middle-Router (Gig0/0) |
| Middle-Router | Gig0/0 |
1.1.1.2 |
255.255.255.0 |
N/A | WAN Link to Left-Router (Gig0/1) |
| Middle-Router | Gig0/1 |
2.1.1.1 |
255.255.255.0 |
N/A | WAN Link to Right-Router (Gig0/0) |
| Right-Router | Gig0/0 |
2.1.1.2 |
255.255.255.0 |
N/A | WAN Link to Middle-Router (Gig0/1) |
| Right-Router | Gig0/1 |
2.1.2.1 |
255.255.255.0 |
N/A | Gateway for Right LAN (Right-SW) |
| MP (Laptop) | Fa0 |
195.1.1.253 |
255.255.255.0 |
195.1.1.254 |
Wired Management Host |
| Laptop0 | Wireless | 195.1.1.2 |
255.255.255.0 |
195.1.1.254 |
Wireless Client (CorpNet) |
| Laptop1 | Wireless | 195.1.1.3 |
255.255.255.0 |
195.1.1.254 |
Wireless Client (CorpNet) |
| PC1 | Wireless | 195.1.1.4 |
255.255.255.0 |
195.1.1.254 |
Wireless Client (CorpNet) |
| PC2 | Fa0 |
2.1.2.2 |
255.255.255.0 |
2.1.2.1 |
Wired Host (Right Site) |
| PC3 | Fa0 |
2.1.2.3 |
255.255.255.0 |
2.1.2.1 |
Wired Host (Right Site) |
🔍 Click to expand Left-Router Configuration
enable
configure terminal
hostname Left-Router
enable secret cisco
interface GigabitEthernet0/0
description Gateway for Left LAN (195.1.1.0/24)
ip address 195.1.1.254 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
description Connection to Middle Router Gig0/0
ip address 1.1.1.1 255.255.255.0
no shutdown
exit
! Extended Access Control List
ip access-list extended WIRELESS_SECURITY
10 permit tcp host 195.1.1.253 host 2.1.1.2 eq 23
20 deny tcp 195.1.1.0 0.0.0.255 host 2.1.1.2 eq 23
30 permit icmp 195.1.1.0 0.0.0.255 host 2.1.1.2
40 permit ip any any
exit
interface GigabitEthernet0/0
ip access-group WIRELESS_SECURITY in
exit
ip route 0.0.0.0 0.0.0.0 1.1.1.2
line con 0
password cisco
login
exit
line vty 0 4
password cisco
login
transport input telnet
exit
end
write memory
🔍 Click to expand Middle-Router Configuration
enable
configure terminal
hostname Middle-Router
enable secret cisco
interface GigabitEthernet0/0
description Connection to Left Router Gig0/1
ip address 1.1.1.2 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
description Connection to Right Router Gig0/0
ip address 2.1.1.1 255.255.255.0
no shutdown
exit
ip route 195.1.1.0 255.255.255.0 1.1.1.1
ip route 2.1.2.0 255.255.255.0 2.1.1.2
line con 0
password cisco
login
exit
line vty 0 4
password cisco
login
transport input telnet
exit
end
write memory
🔍 Click to expand Right-Router Configuration
enable
configure terminal
hostname Right-Router
enable secret cisco
interface GigabitEthernet0/0
description Connection to Middle Router Gig0/1
ip address 2.1.1.2 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
description Gateway for Right LAN (2.1.2.0/24)
ip address 2.1.2.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 2.1.1.1
line vty 0 4
password cisco
login
transport input telnet
exit
end
write memory
- AccessPoint0:
- SSID:
CorpNet - Security:
WPA2-PSK| Encryption:AES - Passphrase:
Cisco123
- SSID:
- Switches (
Left-SW&Right-SW):- Cisco Catalyst 2960 Series configured with flat Access VLAN 1 across all active FastEthernet and GigabitEthernet interfaces.
| Source Device | Connection Type | Target IP | Protocol | Expected Behavior | Status |
|---|---|---|---|---|---|
MP (195.1.1.253) |
Wired | 2.1.1.2 |
Telnet (TCP 23) | Allowed (Prompt for Password) | ✅ PASS |
MP (195.1.1.253) |
Wired | 2.1.2.2 |
ICMP Ping | Successful (4/4 Received) | ✅ PASS |
Laptop0 (195.1.1.2) |
Wireless | 2.1.1.2 |
ICMP Ping | Successful (4/4 Received) | ✅ PASS |
Laptop0 (195.1.1.2) |
Wireless | 2.1.1.2 |
Telnet (TCP 23) | Denied (Connection timed out) |
✅ PASS |
Laptop1 (195.1.1.3) |
Wireless | 2.1.1.2 |
Telnet (TCP 23) | Denied (Connection timed out) |
✅ PASS |
PC1 (195.1.1.4) |
Wireless | 2.1.1.2 |
Telnet (TCP 23) | Denied (Connection timed out) |
✅ PASS |
By Muhammad Ali Mobeen
Packet-Tracer-Enterprise-Network-Lab: PDF of Network Lab.topology.pkt: Cisco Packet Tracer topology file (Lab 4.pkt).Network-Lab: ScreenShot
This project is open-source and available under the MIT License.