R03.06.01.01 · TASK CLASS

Network configuration & simulation

Configure routers, switches, VLANs and firewalls in simulators to meet connectivity requirements.

20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.

Typical applications: Cisco Packet Tracer · GNS3 · pfSense
Class GUI-need label: G2 · GUI-essential

Task proposals · 20

Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.

R03.06.01.01-T01 VLANs with router-on-a-stick in Packet Tracer

Original instruction

Open fixtures/net/vlan_base.pkt in Packet Tracer. Create VLAN 10 (Staff) and VLAN 20 (Guest) on both switches, trunk the switch-to-switch and switch-to-router links, and configure router-on-a-stick subinterfaces so the two VLANs can route to each other. Assign the given host IPs.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: drag · Drag & drop click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Exported running-configs show VLAN 10/20, trunk encapsulation, and dot1q subinterfaces with correct gateways; in-sim ping across VLANs succeeds for all 4 host pairs. Graded on the .pkt state + simulated reachability; a pasted-in config without matching device state is rejected. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

30% VLANs + access ports; 30% trunks; 40% inter-VLAN ping matrix passes

R03.06.01.01-T02 Single-area OSPF across three routers

Original instruction

In fixtures/net/ospf3.pkt, configure OSPF area 0 on routers R1-R3 so every LAN reaches every other LAN. Set R2 as the DR on the shared segment via interface priority, and advertise all connected networks. Use the addressing in the topology notes.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer · GNS3
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: drag · Drag & drop click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

OSPF neighbors are Full; every router's table has routes to all LANs; R2 is DR on the shared segment; full LAN-to-LAN ping matrix passes in-sim. Graded on the project state + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

30% OSPF adjacencies up; 30% full routing table; 20% R2 is DR; 20% full ping matrix

R03.06.01.01-T03 pfSense NAT port-forward for a web server

Original instruction

In the lab pfSense web UI, forward inbound WAN TCP 80 and 443 to the internal web server 10.0.1.10, add the matching firewall pass rules, and block all other inbound WAN traffic. Verify the forward reaches the server from the simulated WAN client.

Platforms: web · Any OS (web)
Applications: pfSense
Interfaces: brow · Browser
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: nav · Pan/zoom/scroll click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

pfSense config shows the two port-forwards to 10.0.1.10 with associated pass rules and a default WAN block; a WAN-side curl to 80/443 reaches the server while other ports are refused. Graded on the saved ruleset + reachability test. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.

Proposed partial credit

40% both port-forwards; 30% associated pass rules; 30% other inbound blocked + reachable

R03.06.01.01-T04 DHCP server and relay across subnets

Original instruction

In fixtures/net/dhcp.pkt, configure a central DHCP server with two pools (VLAN 10: 10.0.10.0/24, VLAN 20: 10.0.20.0/24, each excluding the first 10 addresses and setting the gateway+DNS), and set an ip helper-address on the router so remote-subnet clients get leases.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms drag · Drag & drop
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Both pools defined with correct exclusions/gateway/DNS; the helper-address is set; in-sim, PCs in both VLANs obtain addresses from the right pool. Graded on config + simulated lease assignment. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

40% both pools correct; 30% helper-address relay; 30% clients lease from correct pool

R03.06.01.01-T05 eBGP peering between two AS in GNS3

Original instruction

In fixtures/net/bgp.gns3, establish an eBGP session between AS 65001 (R1) and AS 65002 (R2), advertise 203.0.113.0/24 from R1 and 198.51.100.0/24 from R2, and apply a prefix-list on R2 that denies R1's more-specifics. Confirm both prefixes are learned.

Platforms: lin · Linux win · Windows mac · macOS
Applications: GNS3
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: drag · Drag & drop click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: long · Long-horizon
Proposed difficulty: 5 / 5

Proposed verifier

BGP session is Established; R2 has 203.0.113.0/24 and R1 has 198.51.100.0/24; the prefix-list on R2 filters the specified more-specifics (not in table). Graded on the lab device state + BGP tables. gns3server REST credentials are withheld from the agent, and the server request log must show node and link changes came from the GNS3 GUI client.

Proposed partial credit

30% session Established; 30% prefixes advertised/learned; 40% prefix-list filtering correct

R03.06.01.01-T06 Access control list flow matrix

Original instruction

In fixtures/net/acl.pkt, apply an extended ACL on R1 so that: Staff (10.0.10.0/24) may reach the server on TCP 443 only, Guest (10.0.20.0/24) may reach the internet but not the server, and ICMP to R1 is denied from Guest. Verify with the given test flows.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

The ACL and its interface/direction are correct; the 6 test flows in the topology produce the exact permit/deny outcomes expected. Graded on config + simulated flow results. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

30% ACL entries correct; 20% applied on right interface/direction; 50% test-flow matrix matches

R03.06.01.01-T07 Set the STP root bridge

Original instruction

In fixtures/net/stp.pkt with three switches, make SW1 the root bridge for VLAN 1 by setting its bridge priority to 4096 and SW2 the secondary (8192). Confirm the resulting port roles and that no loop exists.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

SW1 shows priority 4096 and is root for VLAN 1; SW2 is secondary; port roles (root/designated/blocking) match the expected loop-free topology. Graded on spanning-tree state in the sim. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

40% priorities set; 30% SW1 is root; 30% correct port roles / loop-free

R03.06.01.01-T08 LACP EtherChannel between switches

Original instruction

In fixtures/net/etherchannel.pkt, bundle the two links between SW1 and SW2 into a Layer-2 LACP port-channel (active/active), carrying VLANs 10 and 20 as a trunk. Confirm the channel comes up and load-balances.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Port-channel is up with both member ports bundled via LACP (mode active); the channel trunks VLAN 10/20; inter-switch VLAN traffic passes. Graded on the EtherChannel state + trunk config. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

40% LACP bundle up with both members; 30% trunk VLANs; 30% traffic passes

R03.06.01.01-T09 Site-to-site IPsec VPN in pfSense

Original instruction

Two lab pfSense firewalls (Site A 10.1.0.0/24, Site B 10.2.0.0/24) need an IKEv2 IPsec tunnel. Configure phase 1/2 on both with the shared parameters in fixtures/net/ipsec.txt, add firewall rules to allow the tunneled subnets, and verify a host in A can ping a host in B over the tunnel.

Platforms: web · Any OS (web)
Applications: pfSense
Interfaces: brow · Browser
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: nav · Pan/zoom/scroll click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: long · Long-horizon multiapp · Multi-app
Proposed difficulty: 5 / 5

Proposed verifier

Both firewalls show the IPsec SA established with matching P1/P2 params; IPsec firewall rules permit the subnets; cross-site ping succeeds and traffic uses the tunnel. Graded on both configs + reachability. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.

Proposed partial credit

25% P1 established; 25% P2/child SA; 20% firewall rules; 30% cross-site ping over tunnel

R03.06.01.01-T10 Port security on access ports

Original instruction

In fixtures/net/portsec.pkt, enable port security on the three access ports of SW1: max 2 MACs, sticky learning, violation restrict. Pre-authorize the server's MAC on its port as static. Show a third device triggers a violation.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Port security config matches (max 2, sticky, restrict) on the three ports with the server's static MAC; in-sim a third MAC raises a violation counter and the port restricts it. Graded on config + violation behavior. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

40% port-security settings; 30% server static MAC; 30% violation triggers restrict

R03.06.01.01-T11 PAT overload to a single public IP

Original instruction

In fixtures/net/pat.pkt, configure NAT overload (PAT) on R1 so the inside LAN 192.168.0.0/24 shares the single outside address 203.0.113.2. Define the inside/outside interfaces and an ACL for the NAT source. Verify two inside hosts reach the outside server simultaneously.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

ip nat inside/outside set, overload NAT with the source ACL present; the NAT translation table shows both inside hosts mapped to 203.0.113.2 with distinct ports; both reach the server. Graded on config + translation table. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

30% inside/outside + ACL; 30% overload rule; 40% translations for both hosts work

R03.06.01.01-T12 VLSM subnet design and apply

Original instruction

Given 172.16.0.0/22 and the host-count requirements in fixtures/net/vlsm.txt (4 LANs of 500/200/50/10 hosts plus point-to-point links), design a VLSM plan with no overlaps and minimal waste, then apply the addressing to fixtures/net/vlsm.pkt and prove reachability.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

The subnet plan in plan.csv has correct non-overlapping prefix lengths sized to each requirement; device interfaces match the plan; full ping matrix passes in-sim. Graded on the plan + applied config + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

40% correct non-overlapping VLSM plan; 30% applied to interfaces; 30% reachability

R03.06.01.01-T13 Three-interface DMZ on pfSense

Original instruction

Configure the lab pfSense with WAN, LAN (10.0.1.0/24), and DMZ (10.0.2.0/24). Allow LAN to initiate to DMZ and WAN; allow WAN to reach only the DMZ web server on 443; block DMZ from initiating to LAN. Verify the three rules with test flows.

Platforms: web · Any OS (web)
Applications: pfSense
Interfaces: brow · Browser
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: nav · Pan/zoom/scroll click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Interface rules implement the three policies; test flows show LAN->DMZ allowed, WAN->DMZ:443 allowed (other ports blocked), DMZ->LAN blocked. Graded on the saved rules + flow outcomes. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.

Proposed partial credit

30% LAN egress rules; 30% WAN->DMZ:443 only; 40% DMZ->LAN blocked (flow tests)

R03.06.01.01-T14 First-hop redundancy with HSRP

Original instruction

In fixtures/net/hsrp.pkt, configure HSRP on R1 and R2 for VLAN 10 with virtual IP 10.0.10.1, R1 active (priority 110, preempt) and R2 standby. Hosts use .1 as gateway. Demonstrate failover: when R1's uplink drops, R2 takes over with no lasting loss.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: long · Long-horizon
Proposed difficulty: 5 / 5

Proposed verifier

HSRP group shows R1 Active/R2 Standby with the VIP and preempt; after disabling R1's uplink (with interface tracking), R2 becomes Active and host connectivity continues. Graded on HSRP state before/after the induced failure. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

30% HSRP VIP + roles; 20% priority/preempt; 20% interface tracking; 30% failover works

R03.06.01.01-T15 Inter-VLAN routing on an L3 switch

Original instruction

In fixtures/net/l3switch.pkt, enable IP routing on the multilayer switch and create SVIs for VLAN 10 (10.0.10.1/24) and VLAN 20 (10.0.20.1/24) as the VLAN gateways. Assign host ports and confirm the two VLANs route without an external router.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

ip routing enabled; both SVIs up with correct addresses; access ports in the right VLANs; inter-VLAN ping succeeds with no external router in path. Graded on config + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

30% SVIs configured; 20% ip routing on; 20% access ports; 30% inter-VLAN ping

R03.06.01.01-T16 Static and default routing

Original instruction

In fixtures/net/static.pkt (3 routers in a line R1-R2-R3), add static routes so R1 and R3 reach each other's LANs via R2, and give R2 a default route toward the simulated ISP. Verify end-to-end connectivity.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Routing tables contain the correct static entries and R2's default route; R1-LAN to R3-LAN ping succeeds and R2 can reach the ISP address. Graded on config + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

50% static routes correct; 25% default route; 25% end-to-end ping

R03.06.01.01-T17 Traffic shaping and captive portal in pfSense

Original instruction

On the lab pfSense Guest interface, enable a captive portal requiring voucher login and apply a traffic-shaper limiter capping each Guest client to 2 Mbit/s down / 1 Mbit/s up. Verify an un-authenticated client is redirected and a logged-in client is rate-limited.

Platforms: web · Any OS (web)
Applications: pfSense
Interfaces: brow · Browser
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: nav · Pan/zoom/scroll click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Captive portal enabled on Guest with vouchers; limiter pipes set to 2/1 Mbit/s bound to the interface; a pre-auth client is redirected to the portal and a post-auth throughput test stays within the cap. Graded on config + behavior. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.

Proposed partial credit

40% captive portal active; 30% limiter rates set+bound; 30% redirect + rate cap verified

R03.06.01.01-T18 Build a topology from a requirements brief

Original instruction

From the requirements in fixtures/net/brief.md (2 sites, VLANs, OSPF core, inter-site static backup, DHCP, and an ACL policy), build the topology from scratch in a new Packet Tracer file, address every link, and produce a reachability matrix showing all required flows pass and denied flows fail.

Platforms: win · Windows mac · macOS
Applications: Cisco Packet Tracer · GNS3
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: drag · Drag & drop click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: long · Long-horizon
Proposed difficulty: 4 / 5

Proposed verifier

The built topology matches the brief's device/link count and addressing; OSPF + backup route present; DHCP works; the reachability matrix matches the brief's allow/deny spec exactly. Graded on the project file + the full flow matrix. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.

Proposed partial credit

25% topology+addressing; 25% OSPF+backup; 20% DHCP; 30% reachability matrix matches brief

R03.06.01.01-T19 Configure VLANs via IOS CLI (control pair of T01)

Original instruction

Control pair of T01: on the lab devices' IOS command line only (console/SSH, no GUI topology editing), configure VLAN 10/20, access ports, 802.1Q trunks, and router-on-a-stick subinterfaces to meet the same connectivity goal as T01. Save the running-configs.

Platforms: lin · Linux
Applications: GNS3
Interfaces: term · Terminal
GUI need · task setting: CL · CLI-sufficient
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: code · Code & commands type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Saved running-configs contain the VLANs, access/trunk ports, and dot1q subinterfaces; the inter-VLAN ping matrix passes. Graded on configs + reachability; contrasts with the GUI drag-and-configure workflow of T01.

Proposed partial credit

30% VLANs+access; 30% trunks; 40% inter-VLAN reachability

R03.06.01.01-T20 Configure OSPF via IOS CLI (control pair of T02)

Original instruction

Control pair of T02: using only the IOS CLI on R1-R3, bring up OSPF area 0, advertise all connected LANs, and set R2 as DR via interface priority, achieving the same full reachability as T02. Produce ospf_configs.txt with each router's config.

Platforms: lin · Linux
Applications: GNS3
Interfaces: term · Terminal
GUI need · task setting: CL · CLI-sufficient
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: code · Code & commands type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Each router's OSPF config advertises its LANs; neighbors reach Full; R2 is DR on the shared segment; full LAN ping matrix passes. Graded on configs + reachability; contrasts with the GUI build of T02.

Proposed partial credit

30% adjacencies Full; 30% full routing tables; 20% R2 DR; 20% full ping matrix

Mapped research references

Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.

NetArena

In this workflow family

R03.06.01.02 Packet capture analysis