CloudLabBox
Try the free demo

Network+ lab 27 of 27

Capstone: build a secure branch office from a work order

Build a complete branch network from a written work order, with no step-by-step instructions: VLANs and a hardened trunk, router-on-a-stick, DHCP, PAT to the internet, guest isolation, SSH management, time and logging, and switch port security. Checkpoints tell you when each part works.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 4,352 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 27 - Capstone - build a secure branch office from a work order

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
6 vCPU, 4,352 MB
Smallest plan
Lite

The scenario

Harbour Logistics is opening a depot in Felixstowe. The ISP router is live, the kit is racked and cabled, and the devices hold nothing but their names. You have the work order below and the rest of the day. Unlike earlier labs, the tasks say what to achieve, not how: use what you've learned. Work through the checkpoints in order; each one proves a layer before you build on it.

Work order WO-2026-118: Felixstowe depot network

VLANNameSubnetGateway (R1)AddressingSW1 ports
10STAFF10.40.10.0/24.1DHCP .100–.254Gi0/1 (PC1)
30GUEST10.40.30.0/24.1DHCP .100–.254Gi0/2 (PC2)
50SERVERS10.40.50.0/24.1static (SRV1 .10)Gi0/3 (SRV1)
99MGMT10.40.99.0/24.1SW1 is .2none (SVI only)
999PARKINGnonenonenoneunused ports, native VLAN

Requirements

  1. Switching: SW1 Gi0/0 is an 802.1Q trunk to R1, DTP off, native VLAN 999, allowing only 10, 30, 50 and 99. User ports are access ports with PortFast and BPDU guard. Gi1/0–Gi1/3 are shut and placed in VLAN 999.
  2. Routing: R1 routes the four VLANs with router-on-a-stick subinterfaces and has a default route to the ISP (198.51.100.1). SW1 is managed on 10.40.99.2 with R1 as its default gateway. SW1 runs as a layer 2 switch (its start-up configuration already has no ip routing).
  3. DHCP: R1 serves STAFF and GUEST (exclude .1–.99), with gateway .1, DNS server 203.0.113.1 and domain felixstowe.harbour.lab.
  4. Internet: all four VLANs reach the internet through PAT on R1's outside interface Gi0/1.
  5. Guests: the guest VLAN reaches the internet only, nothing in 10.0.0.0/8 (DHCP must still work).
  6. Management: SSH v2 only on R1 and SW1, local user admin / Harb0ur-Adm1n at privilege 15, enable secret Harb0ur-Enable, domain harbour.lab. Only the MGMT and STAFF subnets may open management sessions.
  7. Operations: R1 takes time from the ISP (198.51.100.1) and SW1 from R1. Both send syslog to SRV1 (10.40.50.10).
  8. Port security: PC1's port allows at most 2 MAC addresses, learned as sticky addresses, and restricts violators (drops and logs, doesn't shut).

What you’ll practise

  • Turn a work order into a configuration plan
  • Build VLANs, a trunk and inter-VLAN routing for four networks
  • Provide DHCP, NAT/PAT and a default route to the internet
  • Isolate guests with an ACL while keeping DHCP working
  • Secure management with SSH, local accounts and an access class
  • Add NTP, syslog, port security and parked unused ports, then verify end to end

The tasks

  1. Bring up the server
  2. Plan before you type
  3. Layer 2 (requirement 1)
  4. Layer 3 (requirement 2)
  5. DHCP and the internet (requirements 3 and 4)
  6. Guest isolation (requirement 5)
  7. Secure management (requirement 6)
  8. Operations and port security (requirements 7 and 8)
  9. Verify like an auditor

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - build a secure branch office from a work order6 nodes, 5 links. Every link is listed as text below the diagram.ISPR1SW1PC1PC2SRV1Gi0/0Gi0/1Gi0/0Gi0/0Gi0/2eth0Gi0/1eth0Gi0/3eth0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to R1 Gi0/1
  • R1 Gi0/0 to SW1 Gi0/0
  • SW1 Gi0/1 to PC1 eth0
  • SW1 Gi0/2 to PC2 eth0
  • SW1 Gi0/3 to SRV1 eth0
Nodes in Capstone: build a secure branch office from a work order, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
SRV1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 27 - Capstone - build a secure branch office from a work order and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.