Hands-on challenges

Real-world style scenarios. Read the case, work it out on paper or in Packet Tracer, then check your answer. Each challenge is solved when every question is correct.

Easy Subnetting IPv4

The new branch office

You've been given 192.168.10.0/24 for a new branch office. The manager wants the network split into equal subnets, and each subnet must support at least 50 hosts. You want as many subnets as possible.

1. Which prefix length should you use? (for example /25)

Hint

50 hosts needs 6 host bits, because 2⁶ − 2 = 62.

2. What is the broadcast address of the second subnet?

Hint

With a block size of 64, the subnets start at .0, .64, .128 and .192.

Show full explanation

6 host bits leaves 32 − 6 = 26 network bits, so /26 (mask 255.255.255.192). That gives 4 subnets of 62 usable hosts: .0/26, .64/26, .128/26, .192/26. The second subnet is 192.168.10.64 – 192.168.10.127, so its broadcast is 192.168.10.127.

Medium Switching VLANs Troubleshooting

VLAN 20 can't reach the server

Two switches are connected by a trunk on Gi0/1. Staff in VLAN 10 and VLAN 30 work normally, but a PC on SW2 in VLAN 20 can't reach the file server on SW1, also in VLAN 20. Here is SW1's trunk configuration:

SW1# show running-config interface Gi0/1
interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,30

1. Which VLAN is being blocked on the trunk?

2. Type the interface command that fixes it without removing VLANs 10 and 30.

Hint

The allowed vlan command has a keyword that adds to the existing list instead of replacing it.

Show full explanation

The allowed list only contains 10 and 30, so frames tagged VLAN 20 are dropped on the trunk. Use switchport trunk allowed vlan add 20. Typing switchport trunk allowed vlan 20 on its own would replace the list and break VLANs 10 and 30, a common real-world mistake. Verify with show interfaces trunk.

Hard Security ACLs Firewall

Nobody can reach the HTTPS server

A junior engineer wrote an ACL so that the 10.10.10.0/24 staff network can reach the web server 10.20.20.5 on HTTPS, and everything else is blocked. After applying it, no one can reach the server.

R1# show access-lists 110
Extended IP access list 110
    10 deny ip any any
    20 permit tcp 10.10.10.0 0.0.0.255 host 10.20.20.5 eq 443

1. Which sequence number causes the problem? (type the number)

Hint

A router reads an ACL from top to bottom and stops at the first match.

2. What is the best fix? Change line 20 to permit ip any any Remove line 10. The implicit deny at the end already blocks everything else Apply the ACL outbound instead of inbound Change port 443 to port 80

3. Management now wants only 10.10.10.0/27 allowed. What wildcard mask goes in the ACL?

Hint

Wildcard = 255.255.255.255 minus the subnet mask.

Show full explanation

Line 10 deny ip any any matches every packet first, so line 20 is never reached. Every ACL already ends with an invisible implicit deny any, so simply removing line 10 gives the intended result. A /27 mask is 255.255.255.224, so the wildcard is 0.0.0.31.

Progress is saved in this browser only. Clearing your browser data resets it. New challenges are added regularly. Suggest one at info@fmtechub.com.

Hands-on challenges

Stay up to date by email