CloudLabBox
Try the free demo

CCNA lab 44 of 46

Capstone 1: build a secure dual-stack branch office

Build a complete branch from a requirements list, with no step-by-step instructions: VLANs and a trunk, router-on-a-stick, DHCP, PAT and a default route, IPv6 with SLAAC, SSH-only management from one VLAN, a guest ACL, port security, DHCP snooping and NTP. A grading checklist tells you when you're done.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 5,632 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 44 - Capstone 1 - build a secure dual-stack branch office

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
6 vCPU, 5,632 MB
Smallest plan
Lite

The scenario

Thornbury Credit Union is opening a branch. The kit is racked and cabled: a router (BR-RTR), a switch (BR-SW1), a staff PC (PC1), a guest kiosk (PC2) and the IT admin laptop (H1). The Internet provider (ISP) is already configured. Your brief is a requirements list, not a set of steps: design it, build it, and prove every requirement with the grading checklist at the end.

Addressing plan

NetworkIPv4IPv6Gateway
VLAN 10 STAFF (PC1 on BR-SW1 Gi0/1)10.44.10.0/242001:db8:44:10::/64 (SLAAC).1 / ::1 on BR-RTR
VLAN 20 GUEST (PC2 on BR-SW1 Gi0/2)10.44.20.0/24–.1
VLAN 99 MGMT (H1 on BR-SW1 Gi0/3)10.44.99.0/24: BR-RTR .1, BR-SW1 .2, H1 .10–.1
WAN BR-RTR Gi0/0 – ISP Gi0/0203.0.113.2/30 (ISP .1)2001:db8:ff:44::2/64 (ISP ::1)–
Internet test addresses198.51.100.1 (web)2001:db8:ffff::1–

Requirements

  1. VLANs: create VLANs 10 STAFF, 20 GUEST, 99 MGMT and 999 PARKING on BR-SW1 (VTP transparent, Rapid PVST+). Access ports as in the table; every unused port in VLAN 999, shut down.
  2. Trunk: BR-SW1 Gi0/0 is a static 802.1Q trunk to BR-RTR Gi0/1 carrying only 10, 20 and 99, with VLAN 999 as the native VLAN and DTP off.
  3. Inter-VLAN routing: router-on-a-stick on BR-RTR Gi0/1 with the gateway addresses above. BR-SW1 is managed at 10.44.99.2 with gateway 10.44.99.1.
  4. DHCP: BR-RTR serves VLAN 10 and VLAN 20 (exclude .1–.20; DNS server 198.51.100.53; domain thornbury.lab).
  5. Internet: BR-RTR Gi0/0 is 203.0.113.2/30 with a default route to the ISP. All three branch subnets reach the Internet through PAT on Gi0/0.
  6. IPv6: enable IPv6 routing; VLAN 10 and the WAN as in the table; an IPv6 default route to the ISP. PC1 uses SLAAC. (No NAT for IPv6: the ISP routes 2001:db8:44::/48 to you.)
  7. Management: domain thornbury.lab, 2048-bit RSA, SSH version 2 only, user admin (privilege 15, secret Cl@ssLab1), enable secret Cl@ssEnable1, on BR-RTR and BR-SW1. VTY access only from VLAN 99 (named ACL MGMT-ONLY).
  8. Guest isolation: guests (VLAN 20) may reach the Internet but nothing in 10.0.0.0/8 except DHCP from their gateway. Use a named extended ACL GUEST-IN, placed where it stops the traffic soonest.
  9. Port security on the PC1 and PC2 ports: maximum 2 MACs, sticky, violation restrict.
  10. DHCP snooping on BR-SW1 for VLANs 10 and 20, trusting only the trunk to the router (and not inserting option 82).
  11. NTP: BR-RTR synchronises to the ISP's NTP server, 203.0.113.1, and BR-SW1 to BR-RTR (10.44.99.1). The ISP's virtual router needs about 20 to 25 minutes after it boots before it serves time, and its clients report synchronized about 40 minutes after the start; a reach above 0 in show ntp associations shows they're already talking.

What you’ll practise

  • Turn a written requirements list into a working design and configuration
  • Combine switching, routing, addressing and services in one network
  • Apply Layer 2 and management-plane security as part of the build
  • Verify every requirement with your own tests

The tasks

  1. Plan before you type
  2. Build and test Layer 2
  3. Build and test routing and addressing
  4. Build and test services
  5. Secure it
  6. Grade yourself

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone 1 - build a secure dual-stack branch office6 nodes, 5 links. Every link is listed as text below the diagram.BR-RTRBR-SW1ISPPC1PC2H1Gi0/0Gi0/0Gi0/1Gi0/0Gi0/2eth0Gi0/1eth0Gi0/3eth0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • BR-RTR Gi0/0 to ISP Gi0/0
  • BR-RTR Gi0/1 to BR-SW1 Gi0/0
  • BR-SW1 Gi0/1 to PC1 eth0
  • BR-SW1 Gi0/2 to PC2 eth0
  • BR-SW1 Gi0/3 to H1 eth0
Nodes in Capstone 1: build a secure dual-stack branch office, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
BR-RTRCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
BR-SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 44 - Capstone 1 - build a secure dual-stack branch office and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.