Tests Passed · CCNA-aligned · ⚡ Production-Ready

🚀 Quick Start · 📐 Architecture · ✅ Test Results

Built by students, for students. A production-grade enterprise network — fully designed, configured, and verified in Cisco Packet Tracer, with full redundancy (HSRP + dual core), dynamic routing (OSPF), external edge (BGP + NAT/PAT), per-department segmentation (VLANs + ACLs), and hardened access (Port Security, BPDU Guard, SSH v2).

---

📑 Table of Contents

1. 🎯 About the Project
2. 🏗️ Architecture at a Glance
3. 🌐 Topology Diagram
4. 🧰 Tech Stack
5. 📐 IP Addressing Plan
6. 🗂️ VLAN & Service Plan
7. 🔁 Traffic Flow
8. ⚖️ HSRP Failover
9. 🧩 Protocol Stack
10. 📁 Repository Layout
11. 🚀 Quick Start
12. ✅ Test Results
13. 🧠 Challenges & Solutions
14. 🛣️ Roadmap
15. 👥 Authors
16. 🙏 Acknowledgements
17. 📄 License

---

🎯 About the Project

TechCom is a fictional but realistic mid-sized telecom company whose network we — two IT undergraduates at the University of Ibb, Faculty of Applied Science, Department of Information Technology — designed from a blank canvas as our graduation project.

It is not a toy. Every decision in the design answers a real business question:

Business need	Network answer
"Sales can't go down at 5 PM."	Dual core + HSRP + dual uplinks
"Finance data must be isolated."	Dedicated VLAN + trunk allow-list + ACL target
"We need phones, not just data."	Separate Voice VLAN 150 with HSRP
"We must reach the Internet."	BGP-style edge + NAT/PAT overload
"Plugging in a rogue switch must not break us."	PortFast + BPDU Guard on every access port
"Configuration must be auditable."	SSH v2, local user database, role-based exec

🔬 100% of the test cases passed (see docs/TEST-RESULTS.md).

---

🏗️ Architecture at a Glance

 ┌──────────────────────────────────────────────────────────┐
│ ☁️ Internet / ISP │
│ ISP-Router (8.8.8.1) │
└──────────────┬──────────────────────────┬────────────────┘
│ Se0/0/0 200.100.50.0/30 │ Se0/0/1 200.100.50.4/30
│ │
┌──────────────▼──────┐ ┌─────────▼────────────┐
│ 🟦 CORE-R2 │ │ 🟦 CORE-R1 │
│ HSRP Standby │◄───────►│ HSRP Active │
│ NAT · BGP · OSPF │ │ NAT · BGP · OSPF │
└──┬──────────────┬───┘ └──┬───────────────┬───┘
│ Gi0/0 │ Gi0/1 │ Gi0/0 │ Gi0/1
10.10.255.4/30 │ 10.10.255.12/30 │ 10.10.255.0/30 10.10.255.8/30
│ │ │ │
┌──────────▼────┐ ┌─────▼─────────┐ ┌───▼──────────┐ ┌──▼──────────┐
│ 🟩 DIST-SW1 │ │ 🟩 DIST-SW2 │ │ 🟩 DIST-SW1 │ │ 🟩 DIST-SW2 │
│ HSRP Active │ │ HSRP Standby │ │ HSRP Active │ │ HSRP Standby│
│ OSPF · SVIs │ │ OSPF · SVIs │ │ OSPF · SVIs │ │ OSPF · SVIs │
└──┬────────────┘ └───────┬───────┘ └──────┬───────┘ └──────┬──────┘
│ Trunk + EtherChannel Po1 │ │
│ │ │
┌───────┴────────────────────────────────────────┴──────────────────┴──────┐
│ │
│ 🟨 ACCESS LAYER — One access switch per department │
│ │
│ ACCESS-SW-IT (VLAN 20 + Voice 150) │
│ ACCESS-SW-SUPPORT (VLAN 30 + Voice 150) │
│ ACCESS-SW-FINANCE (VLAN 40 + Voice 150) │
│ ACCESS-SW-HR (VLAN 50 + Voice 150) │
│ ACCESS-SW-SALES (VLAN 60 + Voice 150) │
│ ACCESS-SW-MANAGEMENT (VLAN 10 only — isolated) │
│ │
└───────────────────────────────────────────────────────────────────────────┘

📝 Reading the diagram: every arrow is a physical link. Logical relationships (HSRP, OSPF adjacency, EtherChannel) are noted on the link.

---

🌐 Topology Diagram

flowchart TB
Internet(["☁️ Internet<br/>(ISP Cloud)"])
ISP["🛰️ ISP-Router<br/>8.8.8.1/24"]
R1["🟦 CORE-R1<br/>(HSRP Active · NAT · BGP)"]
R2["🟦 CORE-R2<br/>(HSRP Standby · NAT · BGP)"]
D1["🟩 DIST-SW1<br/>(L3 · HSRP Active)"]
D2["🟩 DIST-SW2<br/>(L3 · HSRP Standby)"]
subgraph ACCESS["🟨 Access Layer — One switch per department"]
SW_IT["ACCESS-SW-IT<br/>VLAN 20 + Voice 150"]
SW_SUP["ACCESS-SW-SUPPORT<br/>VLAN 30"]
SW_FIN["ACCESS-SW-FINANCE<br/>VLAN 40"]
SW_HR["ACCESS-SW-HR<br/>VLAN 50"]
SW_SAL["ACCESS-SW-SALES<br/>VLAN 60"]
SW_MGT["ACCESS-SW-MGMT<br/>VLAN 10 only"]
end
Internet --- ISP
ISP ---|Se0/0/0 200.100.50.0/30| R2
ISP ---|Se0/0/1 200.100.50.4/30| R1
R1 ---|Gi0/0 10.10.255.0/30| D1
R1 ---|Gi0/1 10.10.255.8/30| D2
R2 ---|Gi0/0 10.10.255.4/30| D1
R2 ---|Gi0/1 10.10.255.12/30| D2
D1 ---|Trunk + EC Po1| SW_IT
D2 ---|Trunk + EC Po1| SW_IT
D1 --- SW_SUP
D2 --- SW_SUP
D1 --- SW_FIN
D2 --- SW_FIN
D1 --- SW_HR
D2 --- SW_HR
D1 --- SW_SAL
D2 --- SW_SAL
D1 ---|Trunk VLAN 10 only| SW_MGT
D2 ---|Trunk VLAN 10 only| SW_MGT
classDef core fill:#1f3a8a,stroke:#1e3a8a,color:#fff,stroke-width:2px;
classDef dist fill:#0e7490,stroke:#0e7490,color:#fff,stroke-width:2px;
classDef acc fill:#a16207,stroke:#a16207,color:#fff,stroke-width:2px;
classDef isp fill:#374151,stroke:#374151,color:#fff,stroke-width:2px;
classDef net fill:#16a34a,stroke:#16a34a,color:#fff,stroke-width:2px;
class R1,R2 core;
class D1,D2 dist;
class SW_IT,SW_SUP,SW_FIN,SW_HR,SW_SAL,SW_MGT acc;
class ISP isp;
class Internet net;

Loading

👉 See also:diagrams/02-traffic-flow.md · diagrams/03-vlan-broadcast-domains.md · diagrams/04-hsrp-failover-state.md · diagrams/05-protocol-stack.md

---

🧰 Tech Stack

Layer	Technology	Where
Simulation	Cisco Packet Tracer 8.x	packet-tracer/
Routing	OSPF (single-area), static, simulated BGP	Core + Distribution
First-hop redundancy	HSRP v1 (priority + preempt)	DIST-SW1/2
Switching	802.1Q, EtherChannel (LACP active), PVST+	All switches
Edge services	NAT/PAT overload, ACL 1	CORE-R1 / CORE-R2
Voice	Voice VLAN 150 + DHCP helper	Access + Distribution
Security	SSH v2 (RSA-1024), enable secret, login local	All devices
Hardening	PortFast, BPDU Guard, trunk allow-lists	Every access port
Documentation	Markdown, Mermaid, PowerPoint, PDF	docs/

---

📐 IP Addressing Plan

Full table lives in docs/IP-PLAN.md. TL;DR:

Block	Purpose
10.10.0.0/16	All internal traffic
10.10.10.0/24 … 10.10.150.0/24	One /24 per VLAN/department
10.10.255.0/30 … 10.10.255.12/30	Point-to-point core ↔ distribution
200.100.50.0/30 … 200.100.50.4/30	Public edge to ISP
8.8.8.0/24	Simulated Internet on ISP router

Department gateways (HSRP virtual IPs):

VLAN	Subnet	Gateway (HSRP)
10 — Management	10.10.10.0/24	10.10.10.1
20 — IT	10.10.20.0/24	10.10.20.1
30 — Support	10.10.30.0/24	10.10.30.1
40 — Finance	10.10.40.0/24	10.10.40.1
50 — HR	10.10.50.0/24	10.10.50.1
60 — Sales	10.10.60.0/24	10.10.60.1
99 — Device-plane	10.10.99.0/24	10.10.99.1
150 — Voice	10.10.150.0/24	10.10.150.1

---

🗂️ VLAN & Service Plan

VLAN ID	Name	Role
10	Management	SVI / management plane (SSH, SNMP)
20	IT	IT department + Voice
30	Support	Technical support
40	Finance	Finance (ACL target)
50	HR	Human resources
60	Sales	Sales (QoS-ready)
99	Device-plane	Router ↔ switch protocol traffic
100	Native	Trunk native (must match on every link)
150	Voice (VoIP)	IP phones

Full breakdown & rationale: docs/VLAN-PLAN.md

---

🔁 Traffic Flow

Normal path — Sales PC → Internet

sequenceDiagram
autonumber
participant PC as 💻 Sales PC<br/>(10.10.60.10)
participant ACC as 🟨 ACCESS-SW-SALES
participant D1 as 🟩 DIST-SW1 (HSRP Active)
participant R1 as 🟦 CORE-R1
participant ISP as 🛰️ ISP-Router
participant NET as ☁️ Internet
PC->>ACC: Ping 8.8.8.8
ACC->>D1: Trunk VLAN 60 (EtherChannel Po1)
D1->>R1: OSPF route via Gi0/0 (10.10.255.0/30)
R1->>R1: PAT overload → 200.100.50.5:port
R1->>ISP: Serial0/0/1
ISP->>NET: Static route 0.0.0.0/0 → Gi0/0
NET-->>PC: ICMP echo reply (no drops)

Loading

Failover path — CORE-R1 dies

sequenceDiagram
autonumber
participant PC as 💻 Sales PC
participant D2 as 🟩 DIST-SW2 (was Standby)
participant R2 as 🟦 CORE-R2 (BGP/NAT)
participant ISP as 🛰️ ISP-Router
Note over R1: ❌ CORE-R1 powered off
D2->>D2: HSRP preempt → claim Active
PC->>D2: Ping 8.8.8.8
D2->>R2: OSPF via Gi0/1 (10.10.255.12/30)
R2->>ISP: Serial0/0/0
ISP-->>PC: Reply (zero packet loss observed)

Loading

🔁 See diagrams/02-traffic-flow.md for the complete sequence diagrams including Finance → Sales inter-VLAN traffic.

---

⚖️ HSRP Failover

stateDiagram-v2
[*] --> Normal
Normal: 🟢 DIST-SW1 = Active (prio 110)<br/>DIST-SW2 = Standby (prio 100)
Normal --> Detected: CORE-R1 dies<br/>HSRP hello missed ×3
Detected --> Switched: Gratuitous ARP
Switched: 🟠 DIST-SW2 = Active<br/>DIST-SW1 = Standby
Switched --> Recovered: CORE-R1 back
Recovered --> Normal: Preempt + higher priority

Loading

Priority table:

VLAN	DIST-SW1	DIST-SW2
10, 20, 30, 40, 50, 60, 150	110 (Active)	100 (Standby)
99 (device-plane)	110	90 (intentionally lowest)

🎯 Full state machine: diagrams/04-hsrp-failover-state.md

---

🧩 Protocol Stack

flowchart TB
L7["📚 App/Management — SSH v2 · SNMP · Syslog"]
L4["🛡️ Security — NAT/PAT · ACL · Port Security"]
L3["🌐 L3 — OSPF · BGP · HSRP · Static"]
L2["🔌 L2 — VLANs · 802.1Q · PVST+ · EtherChannel"]
L7 --> L4 --> L3 --> L2

Loading

Protocol	Where	Why
OSPF (Area 0)	Core + Distribution	Dynamic internal routing
BGP (sim.)	Core ↔ ISP	Realistic edge
HSRP v1	DIST-SW1/2	Gateway redundancy
NAT/PAT	CORE-R1/2	Internet sharing
802.1Q	All trunks	VLAN tagging
EtherChannel	Access ↔ Distribution	Aggregated GigE
PortFast + BPDU Guard	Every access port	Edge hardening
SSH v2	All devices	Encrypted mgmt

---

📁 Repository Layout

TechCom-Network/
├── 📄 README.md ← you are here
├── 📄 LICENSE
├── 📄 .gitignore
│
├── 📁 packet-tracer/
│ └── Network Ayman & Alhareth.pkt ← the live lab
│
├── 📁 configs/
│ ├── 📁 configs-Router/
│ │ ├── CORE-R1.conf
│ │ └── CORE-R2.conf
│ ├── 📁 configs-Switch/
│ │ ├── DIST-SW1.conf
│ │ ├── DIST-SW2.conf
│ │ ├── ACCESS-SW-IT.conf
│ │ ├── ACCESS-SW-SUPPORT.conf
│ │ ├── ACCESS-SW-FINANCE.conf
│ │ ├── ACCESS-SW-HR.conf
│ │ ├── ACCESS-SW-SALES.conf
│ │ └── ACCESS-SW-MANAGEMENT.conf
│ └── 📁 configs-ISP/
│ └── ISP-Router.conf
│
├── 📁 diagrams/
│ ├── 01-architecture-overview.md (3-tier Mermaid)
│ ├── 02-traffic-flow.md (sequence diagrams)
│ ├── 03-vlan-broadcast-domains.md (VLAN map)
│ ├── 04-hsrp-failover-state.md (HSRP state machine)
│ └── 05-protocol-stack.md (L2–L7 stack)
│
└── 📁 docs/
├── 📁 arabic/
│ └── تقرير شبكة - TechCom.pdf (original Arabic report)
├── IP-PLAN.md
├── VLAN-PLAN.md
├── TEST-RESULTS.md
├── CHALLENGES.md
└── network_topology.pptx (presentation slides)

---

🚀 Quick Start

▶️ Run the lab

1. InstallCisco Packet Tracer 8.x.
2. Clone this repository:

   git clone https://github.com/<your-username>/TechCom-Network.git
   cd TechCom-Network

3. Open the lab file:

   # Windows
   start """packet-tracer/Network Ayman & Alhareth.pkt"# macOS
   open "packet-tracer/Network Ayman & Alhareth.pkt"# Linux
   pktui "packet-tracer/Network Ayman & Alhareth.pkt"

4. Wait ~30 s for OSPF to converge, then run:

   PC-Sales> ping 8.8.8.8
   PC-IT> ping 10.10.60.10
   

📥 Apply a config to a real device

If you have a physical or virtual IOS device, push a single config:

# Example: copy a switch config to a TFTP server first, then merge# via the device console / VTY.# 1) From the device:
copy running-config tftp:
# 2) Replace the relevant section with the matching .conf file

Or use the lab as a config reference even on real gear — every command is copy-pasteable from the configs/ folder.

🔁 Reproduce a failover test

1. Open the lab.
2. From a Sales PC, run ping -t 8.8.8.8.
3. In Packet Tracer, delete the power connection to CORE-R1.
4. Observe: HSRP reconverges in < 5 s, ping stays green.

---

✅ Test Results

#	Test	Expected	Result
1	Ping across VLANs	Inter-department reply	✅
2	Ping 8.8.8.1	Internet via NAT	✅
3	Traceroute	Path: DIST → CORE → ISP	✅
4	HSRP failover	Zero packet loss on CORE-R1 fail	✅
5	BPDU Guard	Port err-disabled on rogue BPDU	✅
6	OSPF neighbors	Full adjacency	✅

📋 Full breakdown with sample output: docs/TEST-RESULTS.md

---

🧠 Challenges & Solutions

#	Challenge	Fix
1	Duplicate SVI IPs between DIST-SW1/2	Split addresses + HSRP virtual IP
2	HSRP Active/Standby flap	Set priority 110 + preempt, verify failover
3	Native VLAN mismatch	Standardise on VLAN 100, audit every trunk
4	Inter-VLAN silently broken	Enable ip routing, build SVIs, validate with ping
5	NAT inside/outside reversed	Re-tag interfaces, rebuild ACL 1
6	VoIP one-way	Unify VLAN 150, HSRP, switchport voice vlan 150
7	SPOF on distribution layer	Add DIST-SW2 + EtherChannel, validate failover

📚 Full war stories: docs/CHALLENGES.md

---

🛣️ Roadmap

• Three-tier topology with full L2/L3 redundancy
• OSPF + simulated BGP + HSRP
• Per-department VLANs + Voice VLAN 150
• Port Security + BPDU Guard
• EtherChannel access uplinks
• SSH v2 across the fabric
• 100% test pass on failover / inter-VLAN / Internet
• Add real ACL examples for Finance ↔ others
• Add SNMPv3 + NetFlow collector config
• Port to GNS3 / EVE-NG for hypervisor lab
• Add QoS policy template for Voice VLAN 150
• CI workflow: validate .conf syntax on every PR

---

👥 Authors

Alhareth Hayel Al-Dahiah Network Design · Routing · Switching 📧 available on request

Ayman Bashi Al-Baidhani Architecture · Security · Documentation 📧 https:/github/ayman-albaidahi

Supervisor: Dr. Salma Hammoud — University of Ibb, Faculty of Applied Science, Department of Information Technology

---

🙏 Acknowledgements

• University of Ibb — for the lab time and the freedom to break things and rebuild them better.
• Dr. Salma Hammoud — for the steady hand on the steering wheel.
• Cisco Networking Academy — for Packet Tracer.
• The open-source community — for Mermaid, Markdown, and the beautiful shields that make a README shine.

---

📄 License

Released under the MIT License. See LICENSE for the full text. You are free to use, modify, and distribute, provided attribution is kept.

---

⭐ Star this repo if it helped you design, study, or pass an exam ⭐

⭐ If this helped you, give it a star!

Made with ❤️ in Yemen — University of Ibb