Skip to content
QYChan Qing Yee
CV
Menu
Open to Singapore rolesDownload CV
← all projects

Two-storey campus network design

University coursework · 4-person team project

SECR2242 Computer Network · UTM, Semester 2 2023/24

case-study subject · A new Faculty of Computing building — a hypothetical brief

A campus network for a new two-storey faculty building, drawn from a floor plan and built in Cisco Packet Tracer: a single 172.16.36.0/23 carved by VLSM into thirteen subnets sized to the rooms they serve, three routers running static and EIGRP routing side by side, four staff-room VLANs on one router-on-a-stick, and ten DHCP pools reached across routed boundaries by relay agents.

3
Routers
13
Subnets
4
VLANs
10
DHCP pools
Cisco Packet TracerVLSMEIGRPStatic routingVLANsDHCP relay

// the brief

The faculty is outgrowing its space, so the brief was to network a new two-storey building from the floor plan up: four teaching labs and two video-conferencing rooms at first, then four staff rooms added mid-project to test whether the design could absorb growth. One address block was issued — 172.16.36.0/23 — and everything else was ours to decide.

// topology

Three routers, two floors, no single point of failure

The two first-floor routers carry a large lab and a small one each; the ground-floor router carries both conferencing rooms, the link out to the ISP, and every DHCP pool. All three are joined pairwise, so a broken serial link costs a hop rather than a floor. The ISP is deliberately left outside the routing protocol and reached by a static default route instead.

  1. internet edge

    static default route · outside EIGRP

    ISP

  2. routers

    EIGRP 1 + static routes · /30 serial links between all three

    Router-FF-A

    first floor

    Router-FF-B

    first floor

    Router-GF

    ground floor · all 10 DHCP pools

  3. first floor · Router-FF-A

    GP Lab

    172.16.36.64/26

    Security Lab

    172.16.36.128/27

  4. first floor · Router-FF-B

    Network Lab

    172.16.36.0/26

    IoT Lab

    172.16.36.160/27

  5. ground floor · Router-GF

    VC Room 1

    172.16.36.192/29

    VC Room 2

    172.16.36.200/29

  6. staff rooms

    802.1Q trunk off Router-FF-B · fa1/0.10 – fa1/0.40

    Staff Room 1

    VLAN 10 · 172.16.37.0/29

    Staff Room 2

    VLAN 20 · 172.16.37.8/29

    Staff Room 3

    VLAN 30 · 172.16.37.16/29

    Staff Room 4

    VLAN 40 · 172.16.37.24/29

// logical topology — first floor above its routers, ground floor below; per-room access switches collapsed into their room

// the address plan

One /23, thirteen subnets, five masks

Each room was measured before a mask was chosen, largest first, so every subnet lands on its own boundary with no unusable gaps between them. A flat /24 per room would have run out after two rooms; equal-sized subnets would have spent 62 addresses on a two-seat conferencing room. The fit column is that decision audited — hosts the room holds against addresses the mask provides. The three router-to-router links take /30s — two usable addresses each, which is exactly what a point-to-point link can use.

172.16.36.0/23 · every subnet at its true share512 addresses
allocated
252
free
260
subnets
13
largest
/26 · 64
// every block at its exact share of the parent; the hatched tail is unallocated. The three /30 transit links are the thinnest slivers — 12 addresses between them.

  • Network Lab

    subnet
    172.16.36.0/26
    gateway
    172.16.36.62
    32/6252%

  • General Purpose Lab

    subnet
    172.16.36.64/26
    gateway
    172.16.36.126
    31/6250%

  • Computer Security Lab

    subnet
    172.16.36.128/27
    gateway
    172.16.36.158
    25/3083%

  • IoT Lab

    subnet
    172.16.36.160/27
    gateway
    172.16.36.190
    25/3083%

  • Video Conferencing Room 1

    subnet
    172.16.36.192/29
    gateway
    172.16.36.198
    2/633%

  • Video Conferencing Room 2

    subnet
    172.16.36.200/29
    gateway
    172.16.36.206
    2/633%

  • Staff Room 1 · VLAN 10

    subnet
    172.16.37.0/29
    gateway
    172.16.37.1
    4/667%

  • Staff Room 2 · VLAN 20

    subnet
    172.16.37.8/29
    gateway
    172.16.37.9
    4/667%

  • Staff Room 3 · VLAN 30

    subnet
    172.16.37.16/29
    gateway
    172.16.37.17
    4/667%

  • Staff Room 4 · VLAN 40

    subnet
    172.16.37.24/29
    gateway
    172.16.37.25
    4/667%

// design decisions

Five choices that shape the network

topology

Three routers in a triangle, not a chain

Two routers split the first floor between them and a third carries the ground floor, all joined pairwise — so every router has two ways to reach every other one.

  • Teaching load spreads across two devices instead of concentrating on one.
  • Router-GF holds both conferencing rooms and the link out to the ISP.
  • The third leg is what makes dynamic routing worth running: a chain would have nothing to fail over to.

addressing

One /23, cut to the size of each room

Thirteen subnets under five masks came out of a single block. Rooms were measured first and allocated largest-first, so the block was never fragmented.

  • Half the block is still unspoken for — 260 contiguous addresses for the next expansion.
  • The four staff rooms added later fit into the untouched 172.16.37.0 half with nothing renumbered.
  • The /30 transit links cost 12 addresses in total, against 256 if each had taken a /24.

routing

Static and EIGRP on the same three routers

Every prefix is reachable two ways: a static route pinning the predetermined path, and EIGRP learning it independently. Running both put the trade-off on a live routing table rather than in the abstract.

  • Static costs nothing to run, but each router needed four by hand — a count that grows with every room.
  • EIGRP converges on its own and finds the second path around the triangle.
  • Static wins on administrative distance, so EIGRP sits behind it — defensible, but two sources of truth for one prefix.

layer 2

Four staff-room VLANs on one router-on-a-stick

The four staff rooms are separate broadcast domains trunked back to a single physical interface on Router-FF-B and routed by four dot1Q subinterfaces.

  • Access ports are pinned with switchport mode access, so a workstation port can never negotiate a trunk.
  • Each trunk carries an explicit allowed list rather than every VLAN the switch knows about.
  • Staff Rooms 3 and 4 sit on the ground floor but route through a first-floor subinterface — VLANs follow the org chart, not the staircase.

addressing

Ten DHCP pools in one place, reached by relay

Every pool lives on Router-GF. The other two routers forward client broadcasts to it, so a DHCP request crosses routed boundaries that would otherwise stop it dead.

  • An ip helper-address turns a broadcast the router would drop into a unicast it will forward.
  • The VLAN subinterfaces need helper addresses of their own — a trunk does not inherit the physical interface’s relay config.
  • Each pool excludes its gateway and first host, so statically configured addresses are never leased away.
// Router-FF-A · show ip route
Gateway of last resort is not set      172.16.0.0/16 is variably subnetted, 13 subnets, 5 masksS       172.16.36.0/26 [1/0] via 172.16.36.210C       172.16.36.64/26 is directly connected, FastEthernet0/0S       172.16.36.160/27 [1/0] via 172.16.36.210C       172.16.36.208/30 is directly connected, Serial0/0/0D       172.16.36.216/30 [90/2681856] via 172.16.36.214, Serial0/0/1                         [90/2681856] via 172.16.36.210, Serial0/0/0

S is the hand-written route, D is EIGRP’s. The last prefix carries two equal-cost paths — the triangle’s second leg, discovered rather than configured. Where both a static route and an EIGRP route exist for one prefix, the static wins on administrative distance and the dynamic one waits behind it.

// verification

Every room against every room

Every room was pinged from every other room, and every room was made to request a lease. Nothing here is blocked by design — this network has no ACLs — so the grid is a coverage check, and the interesting detail is underneath it.

General Purpose Lab

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — not tested

Computer Security Lab

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — not tested

Network Lab

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — not tested

IoT Lab

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — not tested

Video Conferencing Room 1

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — not tested

Video Conferencing Room 2

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — not tested

Staff Room 1

  • GPGeneral Purpose Lab — reachable
  • CSComputer Security Lab — reachable
  • NETNetwork Lab — reachable
  • IoTIoT Lab — reachable
  • VC1Video Conferencing Room 1 — reachable
  • VC2Video Conferencing Room 2 — reachable
  • SR3Staff Room 3 — reachable
✓ reachable✕ blocked by design· not tested
  • The six original rooms were tested against each other exhaustively — 36 of 36 pairs, before the staff rooms existed.
  • Staff Room 1 was then tested against all seven destinations once the VLANs were trunked in.
  • The blank column is honest rather than passing: the six original rooms were never re-tested against Staff Room 3 after it was added. Re-running the full grid after a change is the habit that column is missing.

// note · Almost every first packet across a router timed out and the following three succeeded. That is ARP resolving a cold cache, not a broken route — and telling the two apart from a 25% loss figure is most of what verification actually is. All ten DHCP pools issued a lease with the correct mask, gateway, and DNS, including through both relay agents.

// what I’d do next

  • Retire the static routes now that EIGRP has converged — two sources of truth for one prefix is a fault waiting for a maintenance window.
  • Move from EIGRP to OSPF: the estate is small enough that the migration is cheap, and it stops the design depending on one vendor.
  • Add switchport port-security and DHCP snooping to the access layer, so an unknown host plugged into a lab port does not simply get an address.
  • Put switch and router management on a VLAN of its own instead of sharing a broadcast domain with lab workstations.
  • Re-run the full connectivity grid after every change, so a column is never left untested the way Staff Room 3 was.

Happy to walk through the subnetting or the routing tables in an interview.

Get in touchqingyee0219@gmail.com