Domain 1 capstone — design a branch office from nothing

capstone · 120 min · Objective 1.8

Task

Produce a complete network design for a 60-person branch office, then build the addressable parts of it in your lab and prove they work. This capstone spans every objective in domain 1: topology, cabling, appliances, ports, traffic types, addressing, subnetting, cloud connectivity and IPv6.

The deliverable is a one-page design plus a working lab that demonstrates the addressing and routing you specified.

Steps

  1. Requirements. 60 staff on wired desks, 40 wireless devices, 12 VoIP phones, 8 servers, 20 cameras, and a management network. Growth of 50% over five years. One 200 Mbps internet circuit. A site-to-site link to a cloud VPC on 10.20.0.0/16.
  2. Address plan. Allocate 10.50.0.0/16 and produce a VLSM plan with one subnet per device class, sized with growth included, largest first. Record network, prefix, gateway and usable count for each. Leave deliberate room between blocks and say why.
  3. Topology and cabling. Decide the physical design — how many switches, where they sit, what connects them — and specify the cabling for each link with a category or fibre type and a distance justification. The uplink from the comms room to a 140 m outbuilding is the one that forces a real choice.
  4. Appliances and traffic. Place a firewall, a router, a switch stack, wireless controller, load balancer and the internet circuit. Then state which traffic type each device class generates — the cameras are the interesting one — and what that implies for switching.
  5. Ports and services. List the ports that must be permitted outbound for the staff network and inbound to the DMZ, with the protocol for each.
  6. Cloud and IPv6. Specify the connectivity to the VPC, and produce an IPv6 plan alongside the IPv4 one: a /48 split into /64s matching your subnets.
  7. Build the proof. Configure two of your planned subnets on the lab hosts, route between them, and demonstrate connectivity matching the plan.

Verify

python3 -c "
import ipaddress
base = ipaddress.ip_network('10.50.0.0/16'); nxt = base.network_address
need = [('wired staff',90),('wireless',60),('cameras',30),('phones',18),('servers',12),('management',10)]
import math
for name, n in need:
    p = 32 - math.ceil(math.log2(n + 2))
    s = ipaddress.ip_network(f'{nxt}/{p}')
    print(f'{name:<14}{str(s):<18}gw {list(s.hosts())[0]}  usable {s.num_addresses-2}  need {n}')
    nxt = s.broadcast_address + 1
print()
print('IPv6: one /64 per subnet out of a site /48 -- subnetting is not the constraint it is in v4')
"
ip -br addr show
ping -c 2 192.168.20.10
traceroute -n 192.168.20.10

Every subnet must be large enough for the grown requirement with a usable count you can point at. The lab half must show two configured subnets and a traceroute crossing between them in two hops.

Notes

Three places this design goes wrong, and the exam knows all of them.

The 140 m run exceeds copper's 100 m limit. The answer is fibre — multimode with an SR optic is ample at that distance — not a longer cable and not a repeater in a wet outbuilding.

The cameras generate steady, high-volume, often multicast traffic. Put them on their own VLAN, and if they multicast, make sure IGMP snooping is on or every switch floods them everywhere.

The growth allowance must be applied before choosing the prefix, not after. Sizing 60 staff into a /26 and then discovering you need 90 means renumbering, which is the most avoidable project in networking.

Keep this design. Domain 2 asks you to implement the switching and routing in it, domain 4 asks you to secure it, and domain 5 asks you to troubleshoot it.