A 12-week educational program for how packets move across campus and branch networks — path and design first, then labs you can break and fix.
This program sits beside Windows Server and Linux: identity and servers only work when the network path is designed and operable. It fits aviation and enterprise IT backgrounds — segmentation, change windows, and “which hop failed?” matter more than vendor exam cramming.
Plan on 10–12 weeks at 4–6 hours per week. GNS3, EVE-NG, Packet Tracer, or a small physical kit is enough. Do not practice on a production or airport/airline live network.
12 weeks
Enterprise network track
4–6 hrs
Study and lab time each week
Packet + path
How traffic moves, not only device UI
Home lab OK
GNS3 / EVE-NG / Packet Tracer / real gear
Skip foundations only if you already troubleshoot VLAN and routing issues without guessing. Otherwise start here, then join week 1 of the architecture program.
Before the enterprise weeks: OSI/TCP-IP, addressing, and “which hop failed?”
One host + Wireshark. Document ARP, DNS, and a failed connection with screenshots of the capture.
Run a home or branch-style lab: VLANs, routing, NAT, and basic ACLs.
Two switches + edge router (virtual OK). Three VLANs, DHCP, NAT, and one ACL between user and server.
Scale the story: sites, redundancy, segmentation, wireless, and ops — fits Windows/Linux estates and aviation IT.
Build the minimum honest lab below, then run the 12-week sequence and the capstone path drill.
Enterprise networking is layered. The lab proves each layer at a smaller scale — it does not pretend a laptop is a campus core.
| Layer | What production looks like | What the lab can prove |
|---|---|---|
| Access | Switched LAN, VLANs, trunks, spanning tree | 2 switches, 3 VLANs, one trunk, STP basics |
| Distribution / core | L3 routing between VLANs, first-hop redundancy | Router-on-a-stick or L3 switch SVIs + default route |
| WAN / edge | Internet edge, NAT, VPN, dual-homing ideas | NAT overload, one site-to-site VPN lab |
| Addressing | IPv4 design, DHCP, DNS as network services | Subnet plan, DHCP scopes, DNS forwarders |
| Wireless | SSID design, controller vs autonomous, guest isolation | One secure SSID + guest VLAN story |
| Security | ACLs, segmentation, jump hosts, zero-trust edges | ACL that allows only needed ports; document exceptions |
| Observability | Syslog, SNMP, NetFlow/IPFIX, packet capture | Capture a failed ping and explain the path |
| Ops | Change windows, runbooks, rollback for network changes | One-page “VLAN change” runbook and a rollback drill |
Path discussion first, then a lab that matches the diagram. Week 12 is a break/fix drill, not a slide recap.
A written subnet plan and a captured ARP/DNS path you can explain.
Three VLANs, trunks, and access ports that match a small floor plan.
Hosts in different VLANs talk; you can draw the hop-by-hop path.
Default route + FHRP or dual-gateway story; test a gateway failure.
Working scopes and name resolution; document failure symptoms.
Inside hosts reach outside; you can explain what NAT hides and breaks.
Least-privilege ACL between user and server VLANs; exceptions listed.
One site-to-site or remote-access lab with a clear trust boundary.
Secure SSID story + guest path that cannot reach servers.
Syslog/SNMP sketch + a Wireshark case for a real failure.
“Link down” and “VLAN change” one-pagers with rollback steps.
Break and fix a multi-VLAN path; write the timeline and root cause.
Two switches, one edge, a few hosts, and a capture you can explain. Green lights without a diagram do not count.
| Piece | Role |
|---|---|
| Platform | GNS3, EVE-NG, Packet Tracer, or two physical switches + a router |
| Nodes | 2 L2/L3 switches, 1 edge router/firewall, 2–3 end hosts (VMs OK) |
| VLANs | Users, servers, management (optional guest) |
| Services | DHCP + DNS on a lab server or router helper |
| Capture | Wireshark on a span/mirror or host NIC |
| Docs | One diagram + addressing table + runbook page |
