From taking a single ping apart layer by layer to the encrypted tunnel that joins two offices across the public internet: segmentation, addressing, routing in all three flavours, link aggregation and security.
Status: Complete. Twenty-seven labs across eight chapters, from a single ping taken apart layer by layer to a whole campus built from an empty rack — every one of them tested end to end on a real bench, in English and Georgian.
How a packet actually travels, and what each layer contributes.
One ping and one web request, followed layer by layer: MAC and ARP, IP and TTL, port, application. The OSI model stops being a table and becomes live traffic.
One physical switch, many logical networks — and how to join them back safely.
Three hosts on one switch, all in the same IP subnet. While the switch is blind they all see each other. Your job is to turn one physical switch into two logical networks.
Three switches in a triangle. Close the third link without protection and the network dies in seconds; with Spanning Tree it blocks one port by itself — and unblocks it the moment a cable fails.
Two VLANs, two subnets and a single link to the router. Build a trunk on the switch and two subinterfaces on the router — one gateway per VLAN.
Two parallel cables between two switches. Plugging both in creates a loop; the right answer is to bond them into one logical link — double the capacity and automatic backup.
Designing address space, in both IPv4 and IPv6.
One block — 172.16.8.0/22 — and three segments with different requirements. Nothing is addressed yet: design first, then assign.
IPv4 already works. Now add IPv6 to the same wires — and let the hosts configure their own addresses, with no DHCP server anywhere.
Static routes, then the three protocols that keep networks converged.
Three routers in a chain with a host at each end. Interfaces are configured, routes are not: every router only knows its own neighbours.
Two paths between two offices: a fast direct link and a slow spare. Configure both so the first one carries traffic and the second takes over by itself when it fails.
Two independent operators, each with its own AS number. They have to peer and announce their networks — this is the protocol the internet itself runs on.
One destination, two paths. BGP picks the shorter AS-path on its own — your job is to change its mind twice, with two different levers.
Two FRR routers and two hosts. The interfaces are configured, OSPF is not. Bring up the adjacency and let the networks propagate themselves.
One OSPF domain split in two areas. The router in the middle belongs to both — and it decides what each side learns about the other.
Three routers in one autonomous system. The focus is the topology table — successor, feasible distance, reported distance: what sets EIGRP apart from the rest.
DHCP, DNS and NAT — the three services an administrator touches every day.
Four packets hand a host its whole network identity. The server sits in one segment and a client in another — and the broadcast stops at the router, which is exactly what a relay is for.
An authoritative server that owns a zone, a recursive resolver that finds answers for clients, and a client that only knows names. Follow one query through all three with dig.
A private network behind a single public address. Masquerade on the way out, DNAT on the way in, and the connection tracking table in front of you — plus the reason hairpin traffic breaks and how to fix it.
What happens when something fails, and how the network recovers on its own.
Two routers share one virtual address. The host knows nothing about it — for it there is a single gateway. When the master fails, the backup takes over the address and the MAC, and the session does not notice.
An internal OSPF domain and an external BGP world, with one router standing on the border. Routes have to cross it in both directions — and the classic trap is right there: without a filter, redistribution builds loops.
Protecting the device you manage, and the traffic that crosses the internet.
A server behind a router, and behind it an internal node you cannot reach directly. Key-based login, passwords disabled — and a tunnel that gets you there anyway.
Three zones, one filtering router and a default-deny policy. Write the rules that let the office out, publish exactly one service in the DMZ, keep the internet away from the inside — and watch the connection tracking table decide which packets are replies.
Two offices with an operator in between that knows nothing about their private networks. Traffic passes only through an encrypted tunnel — and you will see it happen.
A modern VPN in four lines of configuration. Two roaming clients, one office gateway, and one idea that replaces the whole IPsec policy database: cryptokey routing, where a public key alone decides both where a packet goes and whether it is allowed in.
Diagnosing a network that is already broken — the other 80% of the job.
Ping works. SSH connects. Small pages load. Large transfers hang forever and nobody knows why. This is the most misdiagnosed failure in networking, and by the end of this lab you will recognise it in seconds.
A 100 Mbit/s link, 100 ms away, and a backup that crawls at five. Nothing is broken — the link is idle, the servers are bored. Read the handshake, do the bandwidth-delay arithmetic and find out why TCP is refusing to go faster.
Five faults, planted at five different layers, in a network nobody documented. No hints, no list of symptoms — just a user saying it does not work. Work upwards layer by layer, the way it is actually done at three in the morning.
An empty rack, an addressing plan and six requirements. VLANs on the access switch, inter-VLAN routing on the core, OSPF to the edge, NAT towards the operator, a published DMZ and a default-deny policy — everything from the previous twenty-six labs, at once.