3-Tier Hierarchy · HSRP · Transit Switch · EtherChannel · ASA Edge · DMZ · AnyConnect VPN · RADIUS (Kali)
A complete enterprise network built and validated in PNetLab — from the internet edge down to the access ports.
Company: NexusCorp — a growing enterprise opening a new headquarters.
You are the network engineer hired to design and build the entire network from the internet edge down to the access ports, with remote VPN access and centralized RADIUS authentication.
Management requirements:
| # | Requirement |
|---|---|
| 1 | Highly available core (no single point of failure → HSRP) |
| 2 | The firewall must reach both cores even if one core fails (transit switch) |
| 3 | Redundant uplinks between all layers (EtherChannel + mesh) |
| 4 | Segmented network with VLANs per department |
| 5 | Secure internet edge with firewall and DMZ |
| 6 | Remote employees connect via AnyConnect VPN |
| 7 | VPN users authenticate against a RADIUS server (not local accounts) |
| 8 | ASA managed via ASDM from a dedicated management network |
[ INTERNET ]
│
outside
192.168.91.12
[M]───────────[ F = ASA-EDGE ]───────────[R]
mgmt 192.168.81.12 │ \ radius 192.168.71.12
(ASDM PC .204) │ \ (Kali RADIUS .128)
inside DMZ
192.168.100.1 192.168.80.1
│ [ WEB / MAIL / DNS ]
[ SW = TRANSIT-SWITCH ] ◄── VLAN 100
/ \
[ C1 ] [ C2 ] ◄── CORE (HSRP)
active standby
.100.2 .100.3
VIP .100.254
╳ ╳ ╳ ╳ ╳ ╳ ╳ ◄── full mesh
[ D1 ] [ D2 ] ◄── DISTRIBUTION
╳ ╳ ╳ ╳ ╳ ╳ ╳ ◄── full mesh
[ASW1] [ASW2] [ASW3] ◄── ACCESS
│ │ │
endpoints endpoints endpoints
PCs/Phones PCs/Phones PCs/Phones
The ASA connects to SW, and both cores connect to SW. If CORE1 dies, CORE2 becomes HSRP active and still reaches the ASA through SW. No single core failure isolates the edge. ✅
| Network | VMnet | Device IP | ASA Interface IP | Connects To |
|---|---|---|---|---|
| Management | VMnet1 | 192.168.81.204 |
192.168.81.12 |
ASA mgmt → ASDM |
| AnyConnect | VMnet2 | 192.168.91.204 |
192.168.91.12 |
ASA outside → VPN portal |
| RADIUS | VMnet3 | 192.168.71.128 |
192.168.71.12 |
ASA radius → Kali |
💡 Device IP = your Windows PC / Kali VM • ASA Interface IP = the ASA gateway on that segment
| VLAN | Name | Subnet | Gateway (HSRP VIP) |
|---|---|---|---|
| 10 | SERVERS | 192.168.10.0/24 |
192.168.10.1 |
| 20 | MANAGEMENT | 192.168.20.0/24 |
192.168.20.1 |
| 30 | USERS | 192.168.30.0/24 |
192.168.30.1 |
| 40 | VOICE | 192.168.40.0/24 |
192.168.40.1 |
| 50 | PRINTERS | 192.168.50.0/24 |
192.168.50.1 |
| 60 | VPN-CLIENTS | 192.168.60.0/24 |
(on ASA — see note) |
| 70 | GUEST | 192.168.70.0/24 |
192.168.70.1 |
| 99 | NATIVE | (unused) | — |
| 100 | TRANSIT | 192.168.100.0/24 |
192.168.100.254 |
⚠️ VLAN 60 (VPN-CLIENTS): Define the VLAN name, but do NOT create aninterface vlan 60SVI on the cores. The VPN pool lives on the ASA. (See the VLAN 60 bug.)
| Interface | nameif | Security | IP Address | Connects To |
|---|---|---|---|---|
| Gig0/0 | outside |
0 | 192.168.91.12/24 |
VMnet2 (AnyConnect) |
| Gig0/1 | inside |
100 | 192.168.100.1/24 |
TRANSIT-SW (to cores) |
| Gig0/2 | dmz |
50 | 192.168.80.1/24 |
DMZ servers |
| Gig0/3 | radius |
80 | 192.168.71.12/24 |
VMnet3 (Kali RADIUS) |
| Gig0/4 | mgmt |
100 | 192.168.81.12/24 |
VMnet1 (ASDM) |
| Device | IP in VLAN 100 | Role |
|---|---|---|
| ASA inside | 192.168.100.1 |
Edge gateway |
| CORE1 SVI | 192.168.100.2 |
HSRP active |
| CORE2 SVI | 192.168.100.3 |
HSRP standby |
| HSRP VIP | 192.168.100.254 |
What the ASA routes to |
The ASA routes all internal traffic to
192.168.100.254. Whichever core is active answers — failover is invisible to the ASA.
| VLAN | CORE1 (Active .2) |
CORE2 (Standby .3) |
HSRP VIP (.1) |
|---|---|---|---|
| 10 | 192.168.10.2 |
192.168.10.3 |
192.168.10.1 |
| 20 | 192.168.20.2 |
192.168.20.3 |
192.168.20.1 |
| 30 | 192.168.30.2 |
192.168.30.3 |
192.168.30.1 |
| 40 | 192.168.40.2 |
192.168.40.3 |
192.168.40.1 |
| 50 | 192.168.50.2 |
192.168.50.3 |
192.168.50.1 |
| 70 | 192.168.70.2 |
192.168.70.3 |
192.168.70.1 |
Step 1 — Add devices:
1x ASAv → ASA-EDGE (F) — 5 interfaces
1x IOU L2 → TRANSIT-SW (SW)
2x IOU L2 ADVIPSERVICES → CORE1, CORE2 (C1, C2) — L3/SVI capable
2x IOU L2 → D1, D2 (distribution)
3x IOU L2 → ASW1, ASW2, ASW3 (access)
IOSv routers / VPCS → simulated endpoints
3x Cloud node → Cloud-VMnet1 / VMnet2 / VMnet3
Step 2 — VMware adapters (each Cloud = different VMnet):
Cloud-VMnet1 → VMnet1 → ASA Gig0/4 (mgmt)
Cloud-VMnet2 → VMnet2 → ASA Gig0/0 (outside)
Cloud-VMnet3 → VMnet3 → ASA Gig0/3 (radius)
Step 3 — Key cabling:
ASA Gig0/1 → TRANSIT-SW
TRANSIT-SW → CORE1 and TRANSIT-SW → CORE2
CORE1 → D1 and D2 (mesh)
CORE2 → D1 and D2 (mesh)
D1 → all access switches
D2 → all access switches
Step 4 — Kali RADIUS:
NIC on VMnet3 → 192.168.71.128
Gateway → 192.168.71.12 (ASA radius interface)
Step 5 — Build in PHASES and verify each before moving on!
| Phase | Focus |
|---|---|
| 1 | Transit Switch + Core HSRP |
| 2 | EtherChannel: Core → Distribution |
| 3 | Distribution → Access (EtherChannel + switch config) |
| 4 | ASA Edge (5 interfaces) |
| 5 | Kali RADIUS Server |
| 6 | AnyConnect with RADIUS |
! On TRANSIT-SW (simple L2)
hostname TRANSIT-SW
vlan 100
name TRANSIT
spanning-tree mode rapid-pvst
! Port to ASA
interface ethernet 0/0
switchport mode access
switchport access vlan 100
! Port to CORE1
interface ethernet 0/1
switchport mode access
switchport access vlan 100
! Port to CORE2
interface ethernet 0/2
switchport mode access
switchport access vlan 100
! On BOTH CORE1 and CORE2
vlan 10
name SERVERS
vlan 20
name MANAGEMENT
vlan 30
name USERS
vlan 40
name VOICE
vlan 50
name PRINTERS
vlan 60
name VPN-CLIENTS
vlan 70
name GUEST
vlan 99
name NATIVE
vlan 100
name TRANSIT
! STP mode — must match every switch in the network
spanning-tree mode rapid-pvst
! ── CORE1 (Active)
ip routing
interface vlan 100
ip address 192.168.100.2 255.255.255.0
standby 100 ip 192.168.100.254
standby 100 priority 110
standby 100 preempt
no shutdown
! Default route to ASA
ip route 0.0.0.0 0.0.0.0 192.168.100.1
! ── CORE2 (Standby)
ip routing
interface vlan 100
ip address 192.168.100.3 255.255.255.0
standby 100 ip 192.168.100.254
standby 100 priority 100
standby 100 preempt
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.100.1
! ── CORE1 (Active, priority 110) — repeat per VLAN
interface vlan 10
ip address 192.168.10.2 255.255.255.0
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
no shutdown
! Repeat for VLAN 20,30,40,50,70 (HSRP group = VLAN number)
! ── CORE2 (Standby, priority 100) — repeat per VLAN
interface vlan 10
ip address 192.168.10.3 255.255.255.0
standby 10 ip 192.168.10.1
standby 10 priority 100
standby 10 preempt
no shutdown
! Repeat for VLAN 20,30,40,50,70
⚠️ DO NOT createinterface vlan 60. VLAN 60 is the VPN pool — those clients live on the ASA, not the core. An SVI here breaks return traffic to VPN clients.
CORE1# show standby brief → all VLANs Active ✅
CORE2# show standby brief → all VLANs Standby ✅
! CORE1 to D1 (Port-channel 1)
interface range ethernet 0/0 - 1
channel-group 1 mode active
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,60,70
! Repeat the mesh:
! CORE1 → D2 = Port-channel 2
! CORE2 → D1 = Port-channel 3
! CORE2 → D2 = Port-channel 4
! This creates the full mesh from the topology ✅
💡 EtherChannel rule: physical ports only get
channel-group X mode active. All trunk config goes on thePort-channelinterface — configured once, inherited by both members.
! On BOTH D1 and D2
vlan 10
name SERVERS
vlan 20
name MANAGEMENT
vlan 30
name USERS
vlan 40
name VOICE
vlan 50
name PRINTERS
vlan 70
name GUEST
vlan 99
name NATIVE
spanning-tree mode rapid-pvst
! On EACH access switch
vlan 10
name SERVERS
vlan 20
name MANAGEMENT
vlan 30
name USERS
vlan 40
name VOICE
vlan 50
name PRINTERS
vlan 70
name GUEST
vlan 99
name NATIVE
spanning-tree mode rapid-pvst
Reminder:
spanning-tree mode rapid-pvstgoes on ALL switches — Transit, Core, Distribution, and Access.
! ── D1 toward ASW1 (Port-channel 11)
interface range ethernet 0/2 - 3
channel-group 11 mode active
interface Port-channel11
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,70
! ── ASW1 uplink toward D1 (Port-channel 11)
interface range ethernet 0/0 - 1
channel-group 11 mode active
interface Port-channel11
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,70
! Repeat the mesh pattern:
! D1 → ASW2 = Port-channel 12
! D2 → ASW1 = Port-channel 13 (redundancy)
! D2 → ASW2 = Port-channel 14
! D1/D2 → ASW3 = Port-channel 15 / 16
! Each access switch is dual-homed to BOTH distribution switches
! Port layout on ASW1 (NO overlap with uplinks):
! Et0/0-0/1 = uplink to D1 (Po11)
! Et0/2-0/3 = uplink to D2 (Po13)
! Et1/0+ = access ports for PCs/phones ← USE THESE
! ── USER PC port
interface ethernet 1/0
description USER-PC
switchport mode access
switchport access vlan 30
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! ── VOICE port (PC + phone)
interface ethernet 1/1
description IP-PHONE
switchport mode access
switchport access vlan 30
switchport voice vlan 40
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! ── Shutdown unused ports
interface range ethernet 1/2 - 3
switchport mode access
switchport access vlan 999
shutdown
! CORE1 — primary root (it is also HSRP active)
spanning-tree vlan 10,20,30,40,50,70 priority 4096
! CORE2 — secondary root (it is HSRP standby)
spanning-tree vlan 10,20,30,40,50,70 priority 8192
💡 Why root at the core: making CORE1 both the STP root and HSRP active means Layer 2 and Layer 3 paths align — traffic flows
Access → Distribution → CORE1for both switching and routing.
show etherchannel summary → Po11-16 bundled (SU) ✅
show interfaces trunk → VLANs forwarding ✅
show vlan brief → all VLANs active ✅
show spanning-tree vlan 30 → CORE1 is root ✅
hostname ASA-EDGE
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 192.168.91.12 255.255.255.0
no shutdown
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.100.1 255.255.255.0
no shutdown
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 192.168.80.1 255.255.255.0
no shutdown
interface GigabitEthernet0/3
nameif radius
security-level 80
ip address 192.168.71.12 255.255.255.0
no shutdown
interface GigabitEthernet0/4
nameif mgmt
security-level 100
ip address 192.168.81.12 255.255.255.0
no shutdown
! One summary route covers every internal VLAN
route inside 192.168.0.0 255.255.0.0 192.168.100.254
http server enable
http 192.168.81.0 255.255.255.0 mgmt
http 0.0.0.0 0.0.0.0 outside
username admin password Admin@123 privilege 15
aaa authentication http console LOCAL
crypto key generate rsa modulus 2048
# Kali via VMnet3 to ASA radius interface
sudo ip addr add 192.168.71.128/24 dev eth3
sudo ip route add default via 192.168.71.12sudo apt update
sudo apt install freeradius -ysudo nano /etc/freeradius/3.0/clients.confclient ASA-EDGE {
ipaddr = 192.168.71.12
secret = RadiusKey123
shortname = asa-edge
nastype = cisco
}sudo nano /etc/freeradius/3.0/users# Add at the TOP of the file
employee1 Cleartext-Password := "Emp@2024"
employee2 Cleartext-Password := "Emp@2024"
employee3 Cleartext-Password := "Emp@2024"# Real execution (background service)
sudo systemctl restart freeradius
sudo systemctl enable freeradius
# OR debug mode (watch live auth) — stop service first
sudo systemctl stop freeradius
sudo freeradius -Xaaa-server RADIUS-KALI protocol radius
aaa-server RADIUS-KALI (radius) host 192.168.71.128
key RadiusKey123
authentication-port 1812
accounting-port 1813
crypto ca trustpoint SSL-CERT
enrollment self
subject-name CN=192.168.91.12
keypair SSL-CERT
crypto ca enroll SSL-CERT noconfirm
ssl trust-point SSL-CERT outside
ssl server-version tlsv1
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.5.04029-webdeploy-k9.pkg 1
anyconnect enable
ip local pool VPN-POOL 192.168.60.10-192.168.60.100 mask 255.255.255.0
! SPLIT-TUNNEL — what the CLIENT routes through the tunnel (DMZ + VLAN 10 + 20)
access-list SPLIT-ACL standard permit 192.168.80.0 255.255.255.0 ! DMZ
access-list SPLIT-ACL standard permit 192.168.10.0 255.255.255.0 ! VLAN 10
access-list SPLIT-ACL standard permit 192.168.20.0 255.255.255.0 ! VLAN 20
! VPN-FILTER — ENFORCED on the ASA, BIDIRECTIONAL
! (blocks other VLANs from reaching the client AND vice-versa)
access-list VPN-FILTER extended permit ip 192.168.60.0 255.255.255.0 192.168.80.0 255.255.255.0
access-list VPN-FILTER extended permit ip 192.168.60.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list VPN-FILTER extended permit ip 192.168.60.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list VPN-FILTER extended deny ip any any
group-policy NEXUS-POLICY internal
group-policy NEXUS-POLICY attributes
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-ACL
vpn-filter value VPN-FILTER
dns-server value 8.8.8.8
split-tunnel vs vpn-filter: split-tunnel is client-side, one direction (what the client sends). vpn-filter is ASA-enforced, both directions (true security). Use both.
tunnel-group NEXUS-VPN type remote-access
tunnel-group NEXUS-VPN general-attributes
address-pool VPN-POOL
authentication-server-group RADIUS-KALI
default-group-policy NEXUS-POLICY
tunnel-group NEXUS-VPN webvpn-attributes
group-alias NEXUS-VPN enable
! CRITICAL — DefaultWEBVPNGroup also needs RADIUS
! (AnyConnect may land here → password loop if missing)
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group RADIUS-KALI
default-group-policy NEXUS-POLICY
address-pool VPN-POOL
! ── SECTION 1 — NAT EXEMPTION (VPN traffic, NO translation) — MUST come first
object network VPN-POOL-NET
subnet 192.168.60.0 255.255.255.0
object network INTERNAL-NET
subnet 192.168.0.0 255.255.0.0
object network DMZ-NET
subnet 192.168.80.0 255.255.255.0
nat (outside,inside) source static VPN-POOL-NET VPN-POOL-NET destination static INTERNAL-NET INTERNAL-NET
nat (outside,dmz) source static VPN-POOL-NET VPN-POOL-NET destination static DMZ-NET DMZ-NET
! ── SECTION 2 — DYNAMIC PAT (internet access) — comes AFTER exemptions
object network INTERNAL-TO-NET
subnet 192.168.0.0 255.255.0.0
nat (inside,outside) dynamic interface
object network DMZ-TO-NET
subnet 192.168.80.0 255.255.255.0
nat (dmz,outside) dynamic interface
# On Kali (debug mode to watch the request):
sudo freeradius -X! Then on the ASA:
ASA-EDGE# test aaa-server authentication RADIUS-KALI host 192.168.71.128 username employee1 password Emp@2024
INFO: Authentication Successful ✅
The question this lab answers: If CORE1 fails, does CORE2 still reach the firewall?
Step 1 — Confirm CORE1 active on transit VLAN
CORE1# show standby brief → VLAN 100: Active, VIP 192.168.100.254 ✅
Step 2 — Continuous ping from an internal PC to the ASA
PC> ping 192.168.100.1 -t
Step 3 — Kill CORE1 completely
CORE1(config)# interface vlan 100
CORE1(config-if)# shutdown (or power off CORE1 in PNetLab)
Step 4 — CORE2 takes over
CORE2# show standby brief → VLAN 100: now ACTIVE ✅
Step 5 — Ping CONTINUES
→ CORE2 reaches the ASA through TRANSIT-SW ✅
→ The network edge stays reachable ✅
Step 6 — Restore CORE1
CORE1(config-if)# no shutdown → CORE1 preempts back to active ✅
🏆 This is the money screenshot for your portfolio. It proves the transit switch eliminates the single-core point of failure.
Transit + HSRP : show standby brief → CORE1 active, CORE2 standby ✅
CORE1 fails → CORE2 active, still reaches ASA ✅
EtherChannel : show etherchannel summary → all bundled ✅
Inter-VLAN : ping VLAN 30 → VLAN 10 across cores ✅
ASA : show interface ip brief → all 5 interfaces up ✅
RADIUS : test aaa-server authentication → Successful ✅
AnyConnect : https://192.168.91.12 → employee1/Emp@2024
→ RADIUS auth ✅ → VPN IP 192.168.60.x ✅
ASDM : https://192.168.81.12 → loads ✅
Symptom: AnyConnect client reaches the DMZ but NOT internal VLANs. The ASA itself can ping VLAN 10, and the split-tunnel ACL is correct.
Diagnosis:
CORE1# show ip route 192.168.60.0
C 192.168.60.0/24 is directly connected, Vlan60 ← THE BUG
Root cause:
The core had an SVI for VLAN 60 (the VPN pool subnet).
It claimed 60.x as "directly connected", so it tried to
find VPN clients on its own Vlan60 — and dropped the replies.
Fix:
CORE1(config)# no interface vlan 60
CORE2(config)# no interface vlan 60
→ core now routes 60.x to the ASA via its default route ✅
Lesson: the VPN pool subnet must never exist as an SVI on an internal L3 device. Only the ASA owns that pool.
| Problem | Cause | Fix |
|---|---|---|
| Core can't reach ASA | Transit VLAN not on all SW ports | VLAN 100 on all 3 SW ports |
| Both cores active | HSRP group mismatch | Same group # per VLAN |
| RADIUS auth fails | Wrong secret / interface | host 192.168.71.128, secret matches both sides |
| Password loop | DefaultWEBVPNGroup has no RADIUS | Add authentication-server-group RADIUS-KALI to it |
| New network unreachable | Split-tunnel changed, client has old routes | Disconnect / reconnect AnyConnect |
| Failover breaks | ASA routes to core IP not VIP | Route to 192.168.100.254 |
Why the Transit Switch (the whole point)
Without transit switch: ASA → CORE1 only
CORE1 dies → CORE2 active but isolated from ASA ❌
With transit switch: ASA → SW → BOTH cores
CORE1 dies → CORE2 active AND reaches ASA via SW ✅
HSRP on the Transit Network
ASA routes to ONE virtual IP (192.168.100.254).
Active core owns that IP. Core fails → standby takes it.
The ASA never changes its config — failover is invisible.
Full Mesh Redundancy
Core ╳ Distribution (every core to every dist)
Distribution ╳ Access (every dist to every access)
Any single link or device failure → traffic reroutes ✅
Centralized RADIUS
One Kali FreeRADIUS server on its own ASA segment.
All VPN auth goes through it — add/remove users in one place.
Real enterprise AAA.
This lab integrates everything and solves a real design problem (single-core edge isolation) with a transit switch
| Domain | Skills Demonstrated |
|---|---|
| Switching | VLANs, trunking, STP (rapid-pvst) |
| Redundancy | HSRP, EtherChannel, full mesh, transit switch |
| Routing | inter-VLAN SVIs, summary routes |
| Security | ASA, DMZ, NAT, vpn-filter |
| Remote Access | AnyConnect SSL VPN |
| Authentication | RADIUS (real FreeRADIUS on Kali) |
| Design | 3-tier + transit + full mesh |