Systems Administration

Cisco Catalyst 3850 Network Segmentation Lab

This project is a hands-on enterprise-style networking lab built around a Cisco Catalyst 3850 running Cisco IOS XE. It covers VLAN segmentation, Layer 3 switching, inter-VLAN routing, ACL-based access control, DHCP relay, Layer 2 security, secure administration, centralized infrastructure services, and network monitoring.

Two laptops serve as user and administrative endpoints, while a Raspberry Pi provides centralized DHCP, NTP, syslog collection, and SNMPv3-based management. The lab is intentionally segmented into user, administrative, and server networks so routing, security controls, service availability, and troubleshooting can be tested on physical hardware.

IP addresses and subnets shown on this page have been replaced with representative private addressing. Credentials and other environment-specific details are omitted.

    Home Router / Existing LAN (VLAN 1)
                    |
                Gi1/0/1
                    |
            Cisco Catalyst 3850
            Layer 2 + Layer 3
                    |
    +---------------+--------------+                Switch Security Controls:
    |               |              |                 - DHCP Snooping
 Gi1/0/3         Gi1/0/4         Gi1/0/5             - Dynamic ARP Inspection
 VLAN 10         VLAN 20         VLAN 30             - IP Source Guard
 USERS            ADMIN          SERVERS
    |               |              |
 Laptop 1        Laptop 2       Raspberry Pi
 10.100.10.10   10.100.20.10    10.100.30.10
    |               |              |
    +--------- Inter-VLAN ---------+
                 Routing
                    | 
                   ACLs
                  
 Raspberry Pi Infrastructure Services:
   +-------------+-------------+
   |             |             |
   v             v             v
  DHCP          NTP          Syslog
  dnsmasq       chrony       rsyslog
   ^             ^             ^
   |             |             |
 DHCP relay     Time           +---------- SNMPv3 Polling
                                           Pi <------> 3850
            

• Switch: Cisco Catalyst 3850-48P running Cisco IOS XE 16.12
• Segmentation: Separate VLANs for USERS, ADMIN, and SERVERS, alongside the existing home LAN on VLAN 1
• Layer 2 Security: DHCP Snooping, Dynamic ARP Inspection, and IP Source Guard
• Routing: Layer 3 SVIs on the 3850 provide default gateways and inter-VLAN routing
• Access Control: Extended ACLs restrict traffic initiated from the USERS VLAN
• DHCP: Raspberry Pi DHCP server with three scopes and Cisco DHCP relay
• NTP: Raspberry Pi running Chrony as the lab time source for consistent timestamps across network-management services
• Administration: SSH-only switch management with unnecessary HTTP/HTTPS management disabled
• Monitoring: Centralized Cisco syslog collection and authenticated/encrypted SNMPv3 polling from the Raspberry Pi
• Testing: Physical laptops and a Raspberry Pi used to verify DHCP, routing, ACL behavior, and infrastructure services

Network Design

The 3850 performs Layer 3 routing for the three lab VLANs while VLAN 1 remains connected to the existing home network. The lab VLANs are kept logically separate so that traffic policy and infrastructure services can be tested without depending on the normal home LAN.

Physical Port Assignment

Layer 2 Security & Network Management

The lab was extended with Layer 2 security controls and centralized event logging to practice switch hardening, endpoint validation, and operational troubleshooting.

• DHCP Snooping: Builds trusted IP-to-MAC bindings from observed DHCP leases
• Dynamic ARP Inspection: Validates ARP traffic against the DHCP snooping binding table
• IP Source Guard: Restricts access-port traffic to valid source IP and MAC bindings
• Centralized Syslog: Cisco switch events are forwarded to a Raspberry Pi and retained using rsyslog
• SNMPv3: The Raspberry Pi polls switch status and interface information using authenticated and encrypted SNMPv3
• NTP: Chrony provides a shared time source so switch and server logs can be correlated correctly

DHCP Snooping & Dynamic ARP Inspection

DHCP snooping provides the trust data used by the other Layer 2 security controls. Dynamic ARP Inspection compares observed ARP messages against the snooping binding table, while IP Source Guard applies similar source validation to traffic entering configured access ports.

During testing, Dynamic ARP Inspection correctly generated %SW_DAI-4-DHCP_SNOOPING_DENY messages when a client's configured IP address did not match the IP address associated with its MAC address in the DHCP snooping table.

This provided a useful example of why DHCP lease state, host configuration, and switch security bindings must agree. The event was visible both on the switch and through the centralized syslog collector.

SNMPv3 Monitoring

SNMPv3 was configured on the Catalyst 3850 so the Raspberry Pi can query operational information from the switch without relying on plaintext SNMP community strings. The configuration uses SNMPv3 authentication and privacy, providing both message authentication and encryption.

The Raspberry Pi uses command-line SNMP tools to retrieve system state, uptime, interface descriptions, interface status, traffic counters, and error counters. This provides a lightweight headless monitoring workflow without requiring a graphical monitoring platform.

snmp-server view NMS-VIEW iso included
snmp-server group NMS-GROUP v3 priv read NMS-VIEW

snmp-server user <user> NMS-GROUP v3 auth sha <auth-secret> priv aes 128 <privacy-secret>

SNMP is restricted to the Pi with an ACL:

ip access-list standard SNMP-MANAGERS
 permit host 10.100.30.10
 deny any log

snmp-server group NMS-GROUP v3 priv read NMS-VIEW access SNMP-MANAGERS

Example SNMP queries from the management Pi:

# System uptime
snmpget -v3 -l authPriv \
  -u <user> \
  -a SHA -A '<auth-secret>' \
  -x AES -X '<privacy-secret>' \
  10.100.30.1 \
  1.3.6.1.2.1.1.3.0

# Interface descriptions
snmpwalk -v3 -l authPriv \
  -u <user> \
  -a SHA -A '<auth-secret>' \
  -x AES -X '<privacy-secret>' \
  10.100.30.1 \
  1.3.6.1.2.1.2.2.1.2

Additional interface OIDs were used to inspect operational status, inbound/outbound traffic counters, and interface errors. This allowed switch state to be checked remotely from the headless Raspberry Pi.

VLANs and Inter-VLAN Routing

Access ports place each lab endpoint into its intended VLAN. Switch Virtual Interfaces (SVIs) provide the Layer 3 default gateways, and ip routing enables the 3850 to route between the connected VLAN networks.

vlan 10
 name USERS

vlan 20
 name ADMIN

vlan 30
 name SERVERS

interface Vlan10
 ip address 10.100.10.1 255.255.255.0
 no shutdown

interface Vlan20
 ip address 10.100.20.1 255.255.255.0
 no shutdown

interface Vlan30
 ip address 10.100.30.1 255.255.255.0
 no shutdown

ip routing

Endpoint ports use PortFast and BPDU Guard because they connect to end devices rather than downstream switches.

interface GigabitEthernet1/0/3
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable

interface GigabitEthernet1/0/4
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable

interface GigabitEthernet1/0/5
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable

Access Control

The USERS VLAN has an inbound extended ACL. It permits required services while preventing an ordinary user endpoint from freely initiating connections into the ADMIN and SERVERS networks.

ip access-list extended USERS-IN
 5 permit udp any eq 68 any eq 67
 10 permit icmp 10.100.10.0 0.0.0.255 host 10.100.10.1 echo
 20 permit icmp 10.100.10.0 0.0.0.255 host 10.100.30.10 echo
 30 permit tcp 10.100.10.0 0.0.0.255 host 10.100.30.10 eq 8080
 40 permit tcp 10.100.10.0 0.0.0.255 10.100.20.0 0.0.0.255 established
 50 permit icmp 10.100.10.0 0.0.0.255 10.100.20.0 0.0.0.255 echo-reply
 60 deny tcp 10.100.10.0 0.0.0.255 host 10.100.30.10 eq 22 log
 70 deny ip 10.100.10.0 0.0.0.255 10.100.20.0 0.0.0.255 log
 80 deny ip 10.100.10.0 0.0.0.255 10.100.30.0 0.0.0.255 log
 90 deny ip 10.100.10.0 0.0.0.255 10.100.0.0 0.0.0.255 log
 100 permit ip 10.100.10.0 0.0.0.255 any

interface Vlan10
 ip access-group USERS-IN in

The DHCP rule appears before the subnet-specific entries because a client without a lease initially sends from 0.0.0.0:68. ACL match counters were used to confirm which rules were handling test traffic.

Centralized DHCP and DHCP Relay

The Raspberry Pi uses the static address 10.100.30.10/24 with 10.100.30.1 as its gateway. It runs dnsmasq as the authoritative DHCP server for all three lab VLANs.

# /etc/dnsmasq.d/lab-dhcp.conf

port=0
interface=eth0
dhcp-authoritative

dhcp-range=set:vlan10,10.100.10.100,10.100.10.199,255.255.255.0,12h
dhcp-option=tag:vlan10,option:router,10.100.10.1

dhcp-range=set:vlan20,10.100.20.100,10.100.20.199,255.255.255.0,12h
dhcp-option=tag:vlan20,option:router,10.100.20.1

dhcp-range=set:vlan30,10.100.30.100,10.100.30.199,255.255.255.0,12h
dhcp-option=tag:vlan30,option:router,10.100.30.1

DHCP broadcasts do not normally cross routed VLAN boundaries, so VLANs 10 and 20 use the 3850 as a DHCP relay:

interface Vlan10
 ip helper-address 10.100.30.10

interface Vlan20
 ip helper-address 10.100.30.10

VLAN 30 does not require a helper because the DHCP server is directly attached to that broadcast domain. DHCP operation was verified by watching dnsmasq logs while clients released and renewed their leases.

NTP Service

The Raspberry Pi also runs chrony as the lab NTP service. Keeping the switch and infrastructure host on a common time source makes event logs and troubleshooting much easier to correlate.

# /etc/chrony/chrony.conf
allow 10.100.30.0/24

# Local fallback for the isolated lab when upstream time is unavailable
local stratum 10

The 3850 uses the Pi as its preferred NTP server:

ntp source Vlan30
ntp server 10.100.30.10 prefer

Synchronization can be checked with chronyc tracking and chronyc sources -v on the Pi, and show ntp associations, show ntp status, and show clock detail on the switch.

Secure Administration

Remote management uses local authentication over SSH. Telnet is not used, and the unnecessary built-in HTTP/HTTPS management service is disabled.

ip ssh version 2

line vty 0 15
 login local
 transport input ssh

no ip http server
no ip http secure-server

Credentials, secrets, private keys, and other sensitive configuration values are intentionally omitted from public documentation.

Verification and Testing

The lab was tested from both the Cisco and Linux sides instead of considering configuration complete as soon as commands were accepted. Common verification commands included:

# Cisco 3850
show vlan brief
show interfaces status
show ip interface brief
show ip route
show ip arp
show access-lists USERS-IN
show running-config interface Vlan10
show running-config interface Vlan20
show running-config interface Vlan30
show ntp associations
show ntp status
show snmp
show running-config | include snmp
show access-lists SNMP-MANAGERS

# Raspberry Pi
ip addr
ip route
nmcli connection show --active
systemctl status dnsmasq
systemctl status chrony
sudo journalctl -u dnsmasq -f
cat /var/lib/misc/dnsmasq.leases
snmpget ...
snmpwalk ...

# Windows clients
ipconfig /all
ipconfig /release
ipconfig /renew
ping <gateway-or-test-host>

One useful failure test was temporarily removing ip helper-address from an SVI. DHCP then failed for that routed VLAN, demonstrating why a relay is required. Restoring the helper restored DHCP operation.

Monitoring was tested by querying switch uptime and interface state over SNMPv3 while simultaneously watching centralized syslog. For example, disconnecting and reconnecting the USERS laptop generated link-state events in syslog while SNMP reported the current interface state.

This demonstrated the complementary roles of the management services: syslog records events as they occur, SNMP provides current device state and counters, and NTP keeps timestamps consistent between systems.

Operational Notes

The Catalyst switch is intentionally powered down when the lab is not in use. At night, the home-router uplink is moved directly back to the unmanaged switch so the desktop and website Raspberry Pi are not dependent on the lab switch.

The infrastructure Pi maintains two NetworkManager profiles. The lab profile gives it its static VLAN 30 address, while the temporary home profile can be used when Internet access is required for package installation or maintenance.

lab-static
 10.100.30.10/24
 gateway 10.100.30.1

home-dhcp
 automatic DHCP from the normal home LAN
 used temporarily for package installation / maintenance

Runbooks

These runbooks document repeatable troubleshooting procedures for the lab. They focus on verifying the failed layer before changing configuration.

This is a learning environment. Credentials, passwords, secrets, and other private network details are intentionally omitted from public documentation.

show ip dhcp snooping

show ip dhcp snooping binding

show ip arp inspection

show ip arp inspection statistics

show ip verify source

%SW_DAI-4-DHCP_SNOOPING_DENY: Invalid ARP...

show ip dhcp snooping binding

show ip arp inspection statistics

show logging

sudo systemctl status rsyslog

sudo tail -f /var/log/cisco.log

Future Extensions

• Interface utilization graphs
• SPAN / Wireshark packet-capture exercises
• Automated switch configuration backups
• Additional routed lab segments and OSPF experimentation