Proof of concept
I prove designs end to end before they go anywhere near a live network. Routing changes, firewall policy and failover all get tested here first.
Cisco home lab showcase
A three site enterprise home lab, built on real hardware
I am Punit, a senior infrastructure and network architect, and this is my Cisco home lab. I use it for proof of concept work, troubleshooting and certification study. Every Cisco router, switch, IP phone and access point, and every HP server, is physical kit.
3enterprise sites
17Cisco routers
6Cisco switches
27virtual machines
9IP phones
9access points
Purpose
Why I built it
I wanted a place where I can run a real enterprise network end to end, on physical hardware, without putting anything live at risk.
Troubleshooting
When a fault is hard to pin down, I rebuild the scenario here. I can break things on purpose and work through the fix with no risk to anyone.
Learning and certification
The lab covers routing, switching, security, voice, wireless and virtualisation. It has been my study bench for Cisco and VMware certifications.
Topology
How it all connects
The lab models a company called ITS Ltd with offices in London, New York and Dubai. A second company, GAP Ltd, shares the same carrier network from Perth and Sydney. Every ITS Ltd office has two ways out: a private MPLS (Multiprotocol Label Switching) link as the main path, and an internet link as the backup.
Connectivity at a glance
A simplified view I drew from the full diagram further down. The subnets match the real build.
Swipe sideways to see the whole diagram.
Main path. Traffic between the three ITS Ltd offices runs over MPLS. The PE (provider edge) routers keep each customer's routes in its own VRF (virtual routing and forwarding table). The P (provider core) routers in the middle only switch labels, so they never need to know a customer route.
Backup path. Here the link between London's CE (customer edge) and PE routers has failed, so London loses its MPLS route. Its traffic now leaves through the edge firewall and internet router, and reaches New York through a DMVPN (Dynamic Multipoint VPN) tunnel across the simulated internet. The dashed line is the tunnel. Underneath, the packets cross the terminal server like any internet traffic. When the link comes back, MPLS takes over again.
Internet access. Each office goes out through its edge firewall and internet router to the simulated internet on the terminal server. The terminal server has a default route to my home network, so the lab reaches the real internet as well.
Two customers, one core. GAP Ltd sends traffic from Perth to Sydney across the same P routers that carry ITS Ltd. Each customer has its own VRF, so their routes never mix, and they could even use the same private addresses.
Management. From my home network I connect to the terminal server, then open a console session on any router or switch, even when the routing is broken. The iLO (Integrated Lights Out) ports on the three HP servers are on my home network too, so every ESXi host stays reachable.
- MPLS core and ITS Ltd
- GAP Ltd
- Internet
- DMVPN backup
- Site LAN
- Management: console and iLO
MPLS from a carrier style core
Two P (provider core) routers and five PE (provider edge) routers act as the carrier. Each customer gets its own VRF (virtual routing and forwarding table), so ITS Ltd and GAP Ltd share the core but never see each other's routes.
Internet with DMVPN tunnels
Each site has an edge firewall and its own internet router. If the MPLS path fails, traffic moves to DMVPN (Dynamic Multipoint VPN) tunnels built across the internet between the three sites.
Both real and simulated
The terminal server, a Cisco 2811, uses VRFs to act as a public internet between the sites. A default route to my BT Infinity line, through a DrayTek router, gives the lab real internet access too.
Reachable even when the lab is down
The terminal server gives me console access to the kit. The iLO (Integrated Lights Out) ports on the HP servers sit on my home network, 192.168.1.0/24, so I can always reach every host.
The full topology
The detailed build diagram, with every interface and subnet. Open it full size and click to zoom in.
- 1
Home network
Top left. My BT Infinity broadband and home switches. It feeds real internet into the lab and carries the iLO network for all three servers.
- 2
Terminal server
Top centre. A Cisco 2811 on 192.168.1.199. It runs the simulated internet with VRFs and links to each site's internet router on its own /29.
- 3
MPLS core
Centre. Two P routers joined on 1.1.1.0/29, and five PE routers for Perth, London, New York, Dubai and Sydney. All are Cisco 2811s.
- 4
Customer edge
London connects through a CE (customer edge) router. In New York and Dubai the core switch connects straight to the PE. GAP Ltd uses Cisco 1603 CE routers with loopbacks.
- 5
Site LAN
Each site has a layer 3 core switch, a layer 2 PoE (Power over Ethernet) access switch on two uplinks, a voice gateway, three IP phones, three access points and a PC.
- 6
Compute
One VMware ESXi host per site. London and New York run HP DL160s with 11 VMs each, including the full Cisco voice suite. Dubai runs a smaller HP ML110 with 5 VMs.
Capabilities
What the lab can do
Nine areas I can build, test and break on demand, all on the same network.
MPLS L3 VPN core
A carrier style core with P, PE and CE roles. Two customers share it in separate VRFs, so I can test VPN design, customer separation and convergence.
- MPLS
- VRF
- PE and CE
- Cisco 2811
Dual WAN with DMVPN backup
Every site has MPLS as the main path and DMVPN over the internet as the backup. I can pull a link and watch failover and failback happen for real.
- DMVPN
- Failover
- Dual WAN
Real and simulated internet
VRFs on the terminal server act as a public internet between the sites. A default route to my BT line adds real internet access when I need it.
- VRF
- Internet edge
- DrayTek
Firewalls from three vendors
The edge at each site can run a physical Cisco ASA 5510, a virtual Check Point or a virtual Palo Alto. Check Point management and Panorama give central policy control.
- Cisco ASA
- Check Point
- Palo Alto
- Panorama
Campus switching
Layer 3 core switches route between VLANs. Layer 2 PoE access switches power the phones and access points, with two uplinks back to the core.
- Cisco 3750
- Cisco 3560G
- VLANs
- PoE
Unified communications
A multi site voice build with call control, voicemail, presence and a contact centre. Every site has a voice gateway and three IP phones.
- CUCM
- Unity Connection
- CUPS
- UCCX
Wireless
Three access points per site on their own VLAN, managed by a virtual Cisco WLC (Wireless LAN Controller).
- Cisco WLC
- 9 APs
- VLAN 14
Identity and access
Cisco ISE (Identity Services Engine) for network access control. Windows Server 2012 R2 runs Active Directory, DNS, DHCP and TACACS for device logins.
- Cisco ISE
- Active Directory
- TACACS
Virtualisation
VMware ESXi on three HP servers, managed through vCenter, with vMotion to move running VMs between hosts. iLO gives remote console access.
- ESXi
- vCenter
- vMotion
- HP iLO
Sites
Three sites, one standard build
Every ITS Ltd site uses the same port plan and VLAN numbers. Only the WAN handoff and the server size change. That keeps changes repeatable and makes faults easy to compare.
Site 1 · ITS Ltd
London
10.1.x.x- WAN
- CE router to PE London on
21.21.21.0/29 - Internet
- Firewall and internet router on
81.81.81.0/29 - Core
- Cisco 3750, layer 3
- Access
- Cisco 3750 PoE, layer 2
- Voice
- 2811 voice gateway, 3 IP phones
- Wireless
- 3 access points
- Server
- HP DL160, 2 × hex core, 48 GB RAM, 900 GB RAID 5
- iLO
192.168.1.254
11 virtual machines
Windows DC · DNS · DHCP · TACACSCisco ISECisco WLCPalo AltoPanoramaCheck PointCheck Point mgmtCUCMCUCCUPSUCCX
Site 2 · ITS Ltd
New York
10.2.x.x- WAN
- Core switch straight to PE New York on
31.31.31.0/29 - Internet
- Firewall and internet router on
83.83.83.0/29 - Core
- Cisco 3750, layer 3
- Access
- Cisco 3750 PoE, layer 2
- Voice
- 2811 voice gateway, 3 IP phones
- Wireless
- 3 access points
- Server
- HP DL160, 2 × hex core, 48 GB RAM, 900 GB RAID 5
- iLO
192.168.1.253
11 virtual machines
Windows DC · DNS · DHCP · TACACSCisco ISECisco WLCPalo AltoPanoramaCheck PointCheck Point mgmtCUCMCUCCUPSUCCX
Site 3 · ITS Ltd
Dubai
10.3.x.x- WAN
- Core switch straight to PE Dubai on
41.41.41.0/29 - Internet
- Firewall and internet router on
82.82.82.0/29 - Core
- Cisco 3560G, layer 3
- Access
- Cisco 3750 PoE, layer 2
- Voice
- 2811 voice gateway, 3 IP phones
- Wireless
- 3 access points
- Server
- HP ML110, 1 × quad core, 16 GB RAM, 256 GB SSD
- iLO
192.168.1.252
5 virtual machines
Windows DC · DNS · DHCP · TACACSPalo AltoPanoramaCheck PointCheck Point mgmt
A branch style site. It has no call servers of its own, so its phones rely on the call managers in London and New York.
The second customer: GAP Ltd
GAP Ltd has CE routers in Perth and Sydney, both Cisco 1603s, with loopback interfaces standing in for office networks. It shares the MPLS core with ITS Ltd but lives in its own VRF. That lets me prove the two customers stay apart while sharing the same carrier routers.
Show in the diagram
Engineering detail
The numbers behind the diagram
For anyone who wants to check the design: VLANs, addressing, WAN links, the port plan and the compute behind each site.
VLANs (the same at every site)
| VLAN | Purpose | Where it lives |
|---|---|---|
| 11 | Servers and voice gateway | Core switch, ESXi host, voice gateway |
| 12 | Data | PCs on access ports Fa0/1 to 0/6 |
| 13 | Voice | IP phones on access ports Fa0/1 to 0/6 |
| 14 | Wireless access points | Access switch AP ports |
| 17 | Second ESXi network (vMotion) | Core switch to ESXi host, London and New York |
Host addressing
| Site | ESXi on VLAN 11 | ESXi on VLAN 17 | iLO |
|---|---|---|---|
| London | 10.1.1.130/25 | 10.1.7.130/25 | 192.168.1.254/24 |
| New York | 10.2.1.130/25 | 10.2.7.130/25 | 192.168.1.253/24 |
| Dubai | 10.3.1.130/25 | Not used | 192.168.1.252/24 |
Each site has its own 10.x range: London 10.1.x.x, New York 10.2.x.x and Dubai 10.3.x.x. The London voice gateway sits on 10.1.1.250.
Point to point links
| Link | Subnet | Type |
|---|---|---|
| P1 core to P2 core | 1.1.1.0/29 | Provider core |
| P1 core to PE London | 2.2.2.0/29 | Provider core |
| P2 core to PE New York | 3.3.3.0/29 | Provider core |
| P2 core to PE Dubai | 4.4.4.0/29 | Provider core |
| P2 core to PE Sydney | 5.5.5.0/29 | Provider core |
| P1 core to PE Perth | 6.6.6.0/29 | Provider core |
| PE London to CE London | 21.21.21.0/29 | ITS Ltd |
| CE London to London core switch | 10.1.1.0/30 | ITS Ltd |
| PE New York to New York core switch | 31.31.31.0/29 | ITS Ltd |
| PE Dubai to Dubai core switch | 41.41.41.0/29 | ITS Ltd |
| PE Perth to CE Perth | 61.61.61.0/29 | GAP Ltd |
| PE Sydney to CE Sydney | 51.51.51.0/29 | GAP Ltd |
| Terminal server to London internet router | 81.81.81.0/29 | Internet |
| Terminal server to Dubai internet router | 82.82.82.0/29 | Internet |
| Terminal server to New York internet router | 83.83.83.0/29 | Internet |
| Terminal server to home network | 192.168.1.199/24 | Home network |
Public style /29 ranges on the internet and provider links make the lab look and behave like a real carrier and internet path.
Core switch (the same at every site)
| Ports | Connects to |
|---|---|
| Fa0/13 to 0/14 | ESXi host on VLAN 17 (London and New York) |
| Fa0/15 to 0/16 | ESXi host on VLAN 11 |
| Fa0/17 to 0/19 | Edge firewall |
| Fa0/20 | WAN: the CE router in London, the PE router in New York and Dubai |
| Fa0/21 to 0/22 | Voice gateway |
| Fa0/23 to 0/24 | Two uplinks to the access switch |
Access switch
| Ports | Connects to |
|---|---|
| Fa0/1 to 0/6 | IP phones, with a PC behind the phone (data VLAN 12, voice VLAN 13) |
| AP ports | Three access points on VLAN 14 |
| Fa0/23 to 0/24 | Two uplinks to the core switch |
ESXi hosts
| Site | Host | CPU | Memory | Storage | VMs |
|---|---|---|---|---|---|
| London | HP ProLiant DL160 | 2 × hex core 2.93 GHz | 48 GB | 900 GB: 4 × 300 GB 10K disks, RAID 5 | 11 |
| New York | HP ProLiant DL160 | 2 × hex core 2.93 GHz | 48 GB | 900 GB: 4 × 300 GB 10K disks, RAID 5 | 11 |
| Dubai | HP ProLiant ML110 | 1 × quad core 2.93 GHz | 16 GB | 256 GB SSD | 5 |
| Total | 3 hosts | 28 cores | 112 GB | About 2 TB | 27 |
What the VMs do
| Role | Virtual machines |
|---|---|
| Core services | Windows Server 2012 R2 with Active Directory, DNS, DHCP and TACACS |
| Security | Palo Alto firewall and Panorama, Check Point firewall and management server, Cisco ISE |
| Wireless | Cisco Wireless LAN Controller |
| Voice | Cisco Unified Communications Manager (CUCM), Unity Connection (CUC), Presence (CUPS) and Contact Center Express (UCCX) |
| Management | VMware vCenter, with vMotion between hosts |
Hardware
Inside the 42U rack
Every router, switch and server in the diagram is real hardware, racked and cabled in a single 42U cabinet. The virtual firewalls, Cisco ISE and the wireless controller run on those servers. Select any photo to see it larger.
What is in it
The main kit shown in the topology.
- 15 ×Cisco 2811 routersMPLS core and edge, internet routers, voice gateways, terminal server
- 2 ×Cisco 1603 routersGAP Ltd customer edge
- 2 ×Cisco 3750 switchesLayer 3 core in London and New York
- 1 ×Cisco 3560G switchLayer 3 core in Dubai
- 3 ×Cisco 3750 PoE switchesLayer 2 access at each site
- •Cisco ASA 5510Physical edge firewall
- 9 ×Cisco IP phonesThree per site
- 9 ×Cisco access pointsThree per site
- 2 ×HP ProLiant DL160ESXi hosts in London and New York
- 1 ×HP ProLiant ML110ESXi host in Dubai
Workspace
Where the work happens
Kit gets built and configured on the bench before it goes in the rack, and spares are kept close by.
Prestaging area
Three desks with multiple screens, IP phones on the bench and room to stage new kit. I build and test configurations here before a device goes into the rack.
Storage for spares
Cables, power leads, modules and spare parts, sorted by type. A rebuild never waits on a missing lead.
- Patch and console cables by length and colour
- Power leads and adapters
- Spare modules, phones and parts
Expertise
Every area I work in, from the basics up
The lab is where I test ideas. These pages show the knowledge behind it, from the foundations to full designs, with diagrams you can step through and simulations you can try.
Foundations
The basics everything else is built on: how networks move data, addressing, switching, routing, security and how I find faults.
- Networking fundamentalsOSI and TCP/IP, encapsulation and the services every network runs
- IP addressing and subnettingMasks, binary, CIDR, VLSM and IPv6, with a calculator
- Switching and campus LANVLANs, spanning tree, EtherChannel, stacks and gateways
- Routing protocolsStatic, OSPF, EIGRP and BGP, redistribution, VRFs and QoS
- Security fundamentalsEncryption, certificates, IPsec, attacks and Layer 2 defences
- TroubleshootingA structured method, the OSI model, tools and real faults
- Support and service managementIncident, problem and change, patching and end of life
- GlossaryEvery acronym on this site, spelled out and explained
Networks and security
WAN, campus and wireless networks, the security that protects them, and how I automate them.
- SD-WAN and SDNSoftware defined WAN, campus and data centre, run by policy
- WAN, MPLS and VPNMPLS, carrier services, IPsec, GRE and DMVPN
- SD-Access campus fabricLISP, VXLAN and group based policy across the campus
- Wireless and mobileRF, controllers, WPA3, roaming, surveys and private 5G
- SecurityFirewalls, zero trust, access control and routing security
- Firewall platformsHow ASA, FortiGate, Palo Alto and SRX handle a packet
- Load balancingLocal and global load balancing, SSL offload and WAF
- Network automationSource of truth, pipelines, APIs, testing and telemetry
Data centre and cloud
Fabrics, facilities, servers, private and public cloud, and the infrastructure behind AI.
- Data centre networksLeaf and spine fabrics, failure domains and out of band management
- VXLAN EVPN and ACIEVPN route types, packet walks, Cisco ACI and multi site
- VMware NSXOverlay networking, gateways and the distributed firewall
- Data centre facilitiesCapacity, data halls, racks, power, cooling and cabling
- Servers and virtualisationServers, RAID, hypervisors, vSphere and Windows Server
- Private cloud and storageVirtualisation, containers, storage tiers and data protection
- Cloud architectureLanding zones, hybrid links, resilience and automation
- AWS, Azure and Google CloudThe building blocks of each platform, side by side
- AI infrastructureGPU pods, lossless fabrics and the NVIDIA stack
Industry and governance
Plant and building systems, IoT, government frameworks, design authority, resilience and cost.
- Operational technologyPurdue, IEC 62443, plant protocols and industrial data
- IoT and edgeDevices, radios, MQTT, onboarding and edge platforms
- Government and defencePublic frameworks for secure government systems
- Design authorityGovernance, decisions and the delivery lifecycle
- Resilience, risk and costRegulation, availability maths and unit cost models
Experience
Twenty years inside the organisations below
I have led technology programmes for banks, insurers, manufacturers and the NHS. The standards I learnt there are the ones I build to in this lab, and the ones I bring to every client.
Rolls Royce
Aerospace
BNY Mellon
Finance
AVEVA
Industrial
Cisco
Technology
Dyson
Manufacturing
BT
Telecoms
Rio Tinto
Energy
Virgin Money
Finance
Weetabix
Food and drink
Penguin Random House
Publishing
Aviva
Insurance
Zurich
Insurance
Bunzl
Consumer goods
NHS
Healthcare
Primark
Retail
Hansard Global
Finance
Moelis & Company
Finance
Molton Brown
Consumer goods
Santander
Finance
University of Portsmouth
Education
The credentials behind every project I deliver
Certifications, specialist exams and training I have completed, then put to work in this lab and on client projects.
64 listed entries12 vendor sections + specialist training
Cisco 12 certifications
CCIE Security
Written exam
Written exam onlyCCIE Routing and Switching
Written exam
Written exam only
CCNP Enterprise
Enterprise networking
Credential listed
CCNP Routing and Switching
Routing and switching
Credential listedCCDP ARCH
Network design
Credential listed
CCNA Routing and Switching
Routing and switching
Credential listedCCVP
Voice, later renamed CCNP Voice
LegacyCCIP
Service provider
Legacy
Cisco Certified Specialist 4 certifications
- Enterprise Advanced Infrastructure Implementation
- Enterprise Design
- Enterprise Core
- Security Core
Cloud, virtualisation and Microsoft 5 items
Microsoft Azure
Cloud platform
TrainedMCITP and MCSE
Microsoft server infrastructure
Legacy
Solutions Architect Professional
AWS Certified
Credential listed
Google Cloud Platform
Cloud platform
TrainedVMware Certified Professional
VCP5, Data Centre Virtualisation
Credential listed
AI, data centre and accelerated computing 25 certifications
Google Skills 5 certifications
- Security in the World of AI
- Responsible AI: Applying AI Principles with Google Cloud
- Innovating with Google Cloud Artificial Intelligence
- Introduction to Large Language Models
- Introduction to Generative AI
NVIDIA Academy 10 certifications
- NetQ Deployment and Installation
- NVIDIA License System (NLS)
- Base Command Manager Administration
- Cumulus Linux Essentials
- Getting Started with NVIDIA DSX Air
- InfiniBand Essentials
- SONiC Essentials by NVIDIA
- AI for All: From Basics to GenAI Practice
- Cable Validation Tool (CVT) Fundamentals
- Introduction to Networking
OpenAI Academy 7 certifications
- AI Leadership
- AI for Educators
- AI for College Students
- Scope AI Solutions
- Optimize AI Application Performance
- AI Foundations
- Applied AI Foundations
Anthropic Academy 3 certifications
- AI Fluency for creative work
- AI Fluency for builders
- AI Fluency: Framework and foundations
Building systems, OT and site infrastructure 7 items
Building Technologies
Honeywell
Trained
Home and Building Automation
Control4
TrainedBuilding Management Systems
BMS
TrainedHeating, Ventilation and Air Conditioning
HVAC
TrainedOperational Technology
OT
TrainedPower and Electrical
Site power
TrainedFibre and Copper Cabling
Structured cabling
Trained
Audio visual and CCTV 10 certifications
Kramer Academy 9 certifications
- AV Fundamentals
- Audio Specialist
- AV over IP Sales Associate
- AV over IP Installer
- Control System Designer
- Education Spaces and Solutions Designer
- VIA Sales Installer
- QuickLaunch Configuration 102
- QuickLaunch Installer
Hikvision 1 certification
- CCTV Expert
Delivery frameworks, governance and vetting 5 items
PRINCE2
Programme and project governance
FrameworkITIL v3 and v4
Service management
FrameworkTM Forum Architecture
Telecoms frameworks
FrameworkEnterprise Security
Regulatory and security frameworks
FrameworkSC Clearance Eligible
United Kingdom
Eligible
Labels reflect the reference, not verified current status.