Building a Redundant Three-Tier Campus Network with Cisco

Hands-on configuration guide: VLANs, dual-homed access switches, EtherChannel (LACP), Rapid PVST+, HSRP, OSPF, DHCP, DNS, and HTTP.

Building a campus network is easier to understand when the concepts fit into one connected project. In this lab, I designed a classic three-tier topology where access switches connect users, Layer 3 distribution switches perform inter-VLAN routing, and core routers connect the campus to a shared server network.

The goal was more than basic reachability. I wanted redundant uplinks, a standby first-hop gateway, a bundled inter-switch connection, and dynamic routing capable of using alternative paths when a link fails.

The topology has 14 devices & 20 Ethernet links, including 2 parallel DSW-to-DSW EtherChannel members.

1. Network overview

• Access — Devices: AC1, AC2 — Cisco 2960 · Primary functions: User VLAN assignment; dual uplinks; PortFast and BPDU Guard
• Distribution — Devices: DSW1, DSW2 — Cisco 3560 · Primary functions: Inter-VLAN routing; HSRP; LACP; Rapid PVST+; OSPF
• Core — Devices: CORE-R1, CORE-R2 — ISR4331 · Primary functions: Redundant routed backbone; OSPF; server-farm HSRP
• Server access — Devices: SW3 — Cisco 2960 · Primary functions: VLAN 100 shared server subnet
• End systems — Devices: PC1–PC4; DHCP, DNS, and HTTP servers · Primary functions: Client addressing, name resolution, and web service

The server switch is attached directly to both core routers. This is a deliberate lab simplification, not a fully redundant production data-center design. Likewise, there is no internet or ISP connection in this exercise.

VLAN & gateway plan

• VLAN 10: Staff · Subnet: 10.1.10.0/24 · Virtual/default gateway: 10.1.10.1 · Primary HSRP device: DSW1
• VLAN 20: Students · Subnet: 10.1.20.0/24 · Virtual/default gateway: 10.1.20.1 · Primary HSRP device: DSW2
• VLAN 99: Management · Subnet: 10.1.99.0/24 · Virtual/default gateway: 10.1.99.1 · Primary HSRP device: DSW1
• VLAN 100: Server farm · Subnet: 10.1.100.0/24 · Virtual/default gateway: 10.1.100.1 · Primary HSRP device: CORE-R1

Routed point-to-point links

• CORE-R1 Gi0/0 ↔ CORE-R2 Gi0/0 — Address on first device: 10.0.0.1/30 · Address on second device: 10.0.0.2/30
• DSW1 Gi0/1 ↔ CORE-R1 Gi0/1 — Address on first device: 10.0.1.1/30 · Address on second device: 10.0.1.2/30
• CORE-R2 Gi0/1 ↔ DSW2 Gi0/1 — Address on first device: 10.0.2.1/30 · Address on second device: 10.0.2.2/30
• CORE-R1 Gi0/3 ↔ DSW2 Fa0/1 — Address on first device: 10.0.3.1/30 · Address on second device: 10.0.3.2/30
• CORE-R2 Gi0/3 ↔ DSW1 Fa0/1 — Address on first device: 10.0.4.1/30 · Address on second device: 10.0.4.2/30

All five /30 networks participate in OSPF process 10, area 0. The 2diagonal links are important: each distribution switch has a routed connection to both core routers, rather than relying on a single upstream device.

2. Configure the access layer

The two Cisco 2960 switches each connect one staff PC and one student PC. Access ports Fa0/1 and Fa0/2 are assigned VLANs 10 and 20 respectively. Both Gi0/1 and Gi0/2 are configured as 802.1Q trunks permitting VLANs 10, 20, and 99.

The dual-homing is crossed: AC1 Gi0/1 goes to DSW1 Gi0/2, while AC1 Gi0/2 goes to DSW2 Fa0/2. Conversely, AC2 Gi0/1 goes to DSW2 Gi0/2 and AC2 Gi0/2 goes to DSW1 Fa0/2.

Rapid PVST+ controls redundant Layer 2 paths. PortFast and BPDU Guard are enabled only on the PC-facing access ports, not on switch uplinks.

AC1 full lab configuration

enable
configure terminal
hostname AC1
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
!
vlan 10
 name VLAN0010
!
vlan 20
 name VLAN0020
!
vlan 99
 name MANAGEMENT
!
interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 no shutdown
!
interface FastEthernet0/2
 switchport access vlan 20
 switchport mode access
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 no shutdown
!
interface GigabitEthernet0/1
 switchport trunk allowed vlan 10,20,99
 switchport mode trunk
 no shutdown
!
interface GigabitEthernet0/2
 switchport trunk allowed vlan 10,20,99
 switchport mode trunk
 no shutdown
!
interface Vlan99
 ip address 10.1.99.21 255.255.255.0
 no shutdown
!
ip default-gateway 10.1.99.1
!
end
write memory

The management SVI is 10.1.99.21/24, and ip default-gateway 10.1.99.1 points management traffic toward the distribution HSRP virtual IP. Because the 2960 is operating as a Layer 2 switch, its management default gateway is not an inter-VLAN routing configuration.

AC2 full lab configuration

enable
configure terminal
hostname AC2
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
!
vlan 10
 name VLAN0010
!
vlan 20
 name VLAN0020
!
vlan 99
 name MANAGEMENT
!
interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 no shutdown
!
interface FastEthernet0/2
 switchport access vlan 20
 switchport mode access
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 no shutdown
!
interface GigabitEthernet0/1
 switchport trunk allowed vlan 10,20,99
 switchport mode trunk
 no shutdown
!
interface GigabitEthernet0/2
 switchport trunk allowed vlan 10,20,99
 switchport mode trunk
 no shutdown
!
interface Vlan99
 ip address 10.1.99.22 255.255.255.0
 no shutdown
!
ip default-gateway 10.1.99.1
!
end
write memory

AC2 is functionally symmetric with AC1, but its management address is 10.1.99.22/24. Both switches carry Staff, Students, and Management VLANs on each uplink.

3. Configure the distribution layer

The two 3560 switches are the heart of the campus LAN. They provide the Layer 3 SVIs for VLANs 10 and 20, relay DHCP requests to the server farm using ip helper-address, and exchange routing information with the core over OSPF.

They also form a two-link LACP EtherChannel between Fa0/23–Fa0/24. The resulting logical interface Port-channel1 is an 802.1Q trunk carrying VLANs 10, 20, and 99. The EtherChannel increases available bandwidth between distribution switches and avoids treating the two physical members as separate spanning-tree paths.

DSW1 full lab configuration

enable
configure terminal
hostname DSW1
ip routing
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
spanning-tree vlan 10,99 priority 24576
spanning-tree vlan 20 priority 28672
!
vlan 10
 name STAFF
!
vlan 20
 name STUDENTS
!
vlan 99
 name MANAGEMENT
!
interface Port-channel1
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet0/1
 description L3_TO_CORE_R2_GI0_3
 no switchport
 ip address 10.0.4.2 255.255.255.252
 no shutdown
!
interface FastEthernet0/2
 description TRUNK_TO_AC2_GI0_2
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no shutdown
!
interface FastEthernet0/23
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode active
 no shutdown
!
interface FastEthernet0/24
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode active
 no shutdown
!
interface GigabitEthernet0/1
 no switchport
 ip address 10.0.1.1 255.255.255.252
 negotiation auto
 no shutdown
!
interface GigabitEthernet0/2
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 negotiation auto
 no shutdown
!
interface Vlan10
 description STAFF GATEWAY
 ip address 10.1.10.2 255.255.255.0
 ip helper-address 10.1.100.10
 standby 10 ip 10.1.10.1
 standby 10 priority 110
 standby 10 preempt
 no shutdown
!
interface Vlan20
 description STUDENTS GATEWAY
 ip address 10.1.20.2 255.255.255.0
 ip helper-address 10.1.100.10
 standby 20 ip 10.1.20.1
 standby 20 preempt
 no shutdown
!
interface Vlan99
 description MANAGEMENT_GATEWAY
 ip address 10.1.99.11 255.255.255.0
 standby 99 ip 10.1.99.1
 standby 99 priority 110
 standby 99 preempt
 no shutdown
!
router ospf 10
 router-id 1.1.1.1
 passive-interface default
 no passive-interface GigabitEthernet0/1
 network 10.0.1.0 0.0.0.3 area 0
 network 10.1.10.0 0.0.0.255 area 0
 network 10.1.20.0 0.0.0.255 area 0
 network 10.1.99.0 0.0.0.255 area 0
 no passive-interface FastEthernet0/1
 network 10.0.4.0 0.0.0.3 area 0
!
end
write memory

On DSW1, the Staff VLAN 10 gateway 10.1.10.1 uses HSRP group 10 with priority 110 and preempt. DSW1 is also preferred for Management VLAN 99 (priority 110). For VLAN 20, it participates as the lower-priority HSRP peer.

The switch runs ip routing and advertises VLAN 10, VLAN 20, VLAN 99, and both directly connected /30 uplinks into OSPF. User SVIs remain OSPF-passive, so their subnets are advertised without trying to form router adjacencies with PCs.

DSW2 — full lab configuration

enable
configure terminal
hostname DSW2
ip routing
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
spanning-tree vlan 10,99 priority 28672
spanning-tree vlan 20 priority 24576
!
vlan 10
 name STAFF
!
vlan 20
 name STUDENTS
!
vlan 99
 name MANAGEMENT
!
interface Port-channel1
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet0/1
 description L3_TO_CORE_R1_GI0_3
 no switchport
 ip address 10.0.3.2 255.255.255.252
 no shutdown
!
interface FastEthernet0/2
 description TRUNK_TO_AC1_GI0_2
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 no shutdown
!
interface FastEthernet0/23
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode active
 no shutdown
!
interface FastEthernet0/24
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 1 mode active
 no shutdown
!
interface GigabitEthernet0/1
 no switchport
 ip address 10.0.2.2 255.255.255.252
 negotiation auto
 no shutdown
!
interface GigabitEthernet0/2
 switchport trunk allowed vlan 10,20,99
 switchport trunk encapsulation dot1q
 switchport mode trunk
 negotiation auto
 no shutdown
!
interface Vlan10
 description STAFF GATEWAY
 ip address 10.1.10.3 255.255.255.0
 ip helper-address 10.1.100.10
 standby 10 ip 10.1.10.1
 standby 10 preempt
 no shutdown
!
interface Vlan20
 description STUDENTS GATEWAY
 ip address 10.1.20.3 255.255.255.0
 ip helper-address 10.1.100.10
 standby 20 ip 10.1.20.1
 standby 20 priority 110
 standby 20 preempt
 no shutdown
!
interface Vlan99
 description MANAGEMENT_GATEWAY
 ip address 10.1.99.12 255.255.255.0
 standby 99 ip 10.1.99.1
 standby 99 priority 100
 standby 99 preempt
 no shutdown
!
router ospf 10
 router-id 2.2.2.2
 passive-interface default
 no passive-interface GigabitEthernet0/1
 network 10.0.2.0 0.0.0.3 area 0
 network 10.1.10.0 0.0.0.255 area 0
 network 10.1.20.0 0.0.0.255 area 0
 network 10.1.99.0 0.0.0.255 area 0
 no passive-interface FastEthernet0/1
 network 10.0.3.0 0.0.0.3 area 0
!
end
write memory

DSW2 is designed to be the preferred first-hop gateway for Students VLAN 20 through HSRP priority 110. For VLAN 10 and VLAN 99, it is the standby device. Each distribution switch can continue serving the VLAN gateways if its peer becomes unavailable, provided the remaining Layer 2 and Layer 3 paths are operational.

Why the STP priorities matter

The Rapid PVST+ preferences deliberately match the usual active HSRP paths:

• VLAN 10 Preferred STP root: DSW1, priority 24576 · HSRP preferred active: DSW1
• VLAN 20 Preferred STP root: DSW2, priority 24576 · HSRP preferred active: DSW2
• VLAN 99 Preferred STP root: DSW1, priority 24576 · HSRP preferred active: DSW1

The opposing distribution switch has a configured STP priority of 28672 for these VLANs. This alignment helps avoid unnecessarily forwarding traffic over the inter-distribution link just to reach the active default gateway. Actual STP port roles still depend on the active topology and bridge IDs.

4. Configure the core routers

CORE-R1 and CORE-R2 provide an OSPF-routed backbone. They have a direct /30 interconnect, one routed link to each distribution switch, and a shared server network on Gi0/2.

Get no Shut Network’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Unlike the user VLANs, VLAN 100 has its first-hop redundancy on the core routers, not on DSW1 or DSW2. The core routers share HSRP virtual address 10.1.100.1 on the server subnet.

CORE-R1 — full lab configuration

enable
configure terminal
hostname CORE-R1
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 no shutdown
!
interface GigabitEthernet0/1
 ip address 10.0.1.2 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 no shutdown
!
interface GigabitEthernet0/2
 ip address 10.1.100.2 255.255.255.0
 standby 100 ip 10.1.100.1
 standby 100 priority 110
 standby 100 preempt
 duplex auto
 speed auto
 media-type rj45
 no shutdown
!
interface GigabitEthernet0/3
 description L3_TO_DSW2_FA0_1
 ip address 10.0.3.1 255.255.255.252
 no shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 10
 router-id 11.11.11.11
 passive-interface default
 no passive-interface GigabitEthernet0/0
 no passive-interface GigabitEthernet0/1
 network 10.0.0.0 0.0.0.3 area 0
 network 10.0.1.0 0.0.0.3 area 0
 network 10.1.100.0 0.0.0.255 area 0
 no passive-interface GigabitEthernet0/3
 network 10.0.3.0 0.0.0.3 area 0
!
end
write memory

CORE-R1 has server-side interface address 10.1.100.2/24 and HSRP priority 110; it is the preferred active gateway for the DHCP, DNS, and HTTP servers.

CORE-R2 full lab configuration

enable
configure terminal
hostname CORE-R2
!
interface GigabitEthernet0/0
 ip address 10.0.0.2 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 no shutdown
!
interface GigabitEthernet0/1
 ip address 10.0.2.1 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 no shutdown
!
interface GigabitEthernet0/2
 ip address 10.1.100.3 255.255.255.0
 standby 100 ip 10.1.100.1
 standby 100 priority 90
 standby 100 preempt
 duplex auto
 speed auto
 media-type rj45
 no shutdown
!
interface GigabitEthernet0/3
 description L3_TO_DSW1_FA0_1
 ip address 10.0.4.1 255.255.255.252
 no shutdown
 duplex auto
 speed auto
 media-type rj45
!
router ospf 10
 router-id 22.22.22.22
 passive-interface default
 no passive-interface GigabitEthernet0/0
 no passive-interface GigabitEthernet0/1
 network 10.0.0.0 0.0.0.3 area 0
 network 10.0.2.0 0.0.0.3 area 0
 network 10.1.100.0 0.0.0.255 area 0
 no passive-interface GigabitEthernet0/3
 network 10.0.4.0 0.0.0.3 area 0
!
end
write memory

CORE-R2 is the standby server gateway with address 10.1.100.3/24 and HSRP priority 90. Either router can route to the campus VLANs through its OSPF adjacencies if the alternative paths remain available.

OSPF design choices

The four Layer 3 devices use OSPF process 10, area 0 with unique, manually configured router IDs: DSW1 1.1.1.1, DSW2 2.2.2.2, CORE-R1 11.11.11.11, and CORE-R2 22.22.22.22.

passive-interface default ensures that OSPF hellos are sent only on explicitly listed router-to-router interfaces. This keeps client/server-facing networks advertised without introducing unnecessary adjacency attempts. A normal working state would show each distribution switch adjacent to both core routers, and the core routers adjacent to one another.

5. Configure the server switch

SW3 provides Layer 2 access to the server farm. All connected ports — Gi0/1 and Gi0/2 toward the core routers and Fa0/1–Fa0/3 toward the three servers — belong to VLAN 100. These are access ports, not trunks; the routed core interfaces attach directly to the common untagged server VLAN.

SW3 full lab configuration

enable
configure terminal
hostname SW3
spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree extend system-id
!
vlan 100
 name SERVERS
!
interface FastEthernet0/1
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
interface FastEthernet0/2
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
interface FastEthernet0/3
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
interface GigabitEthernet0/1
 switchport access vlan 100
 switchport mode access
 no shutdown
!
interface GigabitEthernet0/2
 switchport access vlan 100
 switchport mode access
 no shutdown
!
end
write memory

Only server-facing access ports use PortFast and BPDU Guard. The ports toward the core routers do not receive those end-device protections.

6. DHCP, DNS, HTTP, and client configuration

The three servers have static addresses within VLAN 100, and all use the core HSRP VIP as the default gateway.

• DHCP-SERVER — IPv4 address: 10.1.100.10/24 · Gateway: 10.1.100.1 · Service: DHCP relay target
• DNS-SERVER — IPv4 address: 10.1.100.11/24 · Gateway: 10.1.100.1 · Service: Resolves www.campus.local
• HTTP-SERVER — IPv4 address: 10.1.100.12/24 · Gateway: 10.1.100.1 · Service: Hosts a basic web page

DHCP scopes

• VLAN10-POOL — Start address: 10.1.10.50 · Mask: 255.255.255.0 · Gateway: 10.1.10.1 · DNS: 10.1.100.11 · Max leases: 50
• VLAN20-POOL — Start address: 10.1.20.50 · Mask: 255.255.255.0 · Gateway: 10.1.20.1 · DNS: 10.1.100.11 · Max leases: 50

On both distribution switches, ip helper-address 10.1.100.10 appears under Vlan10 and Vlan20. This forwards broadcast DHCP client requests to the DHCP server across the routed campus.

In the simulator, configure the DHCP service on DHCP-SERVER, the DNS A record www.campus.local → 10.1.100.12 on DNS-SERVER, and the HTTP service on HTTP-SERVER. All four PCs are configured to obtain IPv4 addresses dynamically. PC1 and PC3 are on VLAN 10; PC2 and PC4 are on VLAN 20.

7. Verification checklist capture your real results

I would verify the design in layers before testing failover. These are the exact commands I would run; the expected conditions below are not fabricated simulator outputs.

Layer 2: VLANs, trunks, and LACP

show vlan brief
show interfaces trunk
show etherchannel summary
show spanning-tree vlan 10
show spanning-tree vlan 20
show spanning-tree vlan 99

Check that both distribution switches show Port-channel1 with Fa0/23 and Fa0/24 bundled, and that access uplinks permit VLANs 10, 20, and 99. An RSTP alternate/discarding port on a redundant Layer 2 path is not necessarily an error.

Layer 3: HSRP & OSPF

show ip interface brief
show standby brief
show ip ospf neighbor
show ip route ospf
show ip route

HSRP should elect DSW1 for VLANs 10 and 99, DSW2 for VLAN 20, and CORE-R1 for VLAN 100 under normal healthy conditions. OSPF should provide campus-to-server routes on the Layer 3 devices.

Services & end-to-end connectivity

From each client, confirm its DHCP address, gateway, and DNS server. Then test these commands as appropriate for the simulator PC command prompt:

ipconfig /all
ping 10.1.10.1
ping 10.1.20.1
ping 10.1.100.10
ping 10.1.100.11
ping 10.1.100.12
tracert 10.1.100.12

Open http://www.campus.local in the PC browser to test DNS resolution and the HTTP server together. A ping toward a possible DHCP lease address such as 10.1.20.52 is meaningful only after confirming that a real host has received that address and is reachable.

Planned failure scenarios

• Routed-uplink failure Action: Shut down CORE-R1 Gi0/1 · Expected result to verify: DSW1 can still reach core through CORE-R2 over its diagonal link
• Opposite uplink failure Action: Shut down CORE-R2 Gi0/1 · Expected result to verify: DSW2 can still reach core through CORE-R1 over its diagonal link
• EtherChannel member failure Action: Shut down DSW1 Fa0/23 · Expected result to verify: Port-channel1 remains operational through Fa0/24
• Distribution HSRP failure Action: Disable DSW1 VLAN 10 SVI or device · Expected result to verify: DSW2 takes over 10.1.10.1, assuming the VLAN remains connected
• Server HSRP failure Action: Disable CORE-R1 Gi0/2 or device · Expected result to verify: CORE-R2 takes over 10.1.100.1, assuming the VLAN remains connected

Bring every test interface back with no shutdown and check state convergence again. For deeper troubleshooting, compare show ip ospf neighbor, show ip route, and show standby brief before and after a test.

💡 Build this lab yourself: All the diagrams and CLI configs you saw here were created using PingMyNetwork. If you’re studying for the CCNA or learning network engineering from scratch, check out PingMyNetwork.com to practice hands-on right inside your browser.