🏗️ CML Lab Rebuild, Part 2: The Five-Node Foundation (and a Plot Twist!)

🤔 The Original Plan vs. The Plot Twist

I’ll admit, I was so excited to start labbing that I completely jumped the gun right after adding the nodes! My original plan was to just copy the exact same layout and VLAN scheme from my old CCNA lab and build a classic compact HQ with a collapsed core. That old lab was basically built like a Lego set — completely unplanned and snapped together piece by piece as I progressed through my lectures. I managed to build it, and while it wasn't perfect, hey, everyone starts somewhere! 🤷‍♂️

It was a very happy-go-lucky approach back then, and while it was great for getting my feet wet, I realized that for this rebuild, I need to actually plan in advance instead of just winging it. I didn't want to just copy-paste my past work; I wanted a genuine learning experience and enjoy the process. So, after taking a step back and doing some research on modern network topologies, I decided to rip up the original plan and pivot to a Routed Campus Design. 🔄

Instead of dealing with Spanning Tree (STP) blocking ports and stretching Layer 2 domains, we are pushing Layer 3 routing all the way down. STP still sticks around for local Layer 2 protection, but it's officially fired from its job of controlling upstream routed paths! 🛑 Instead, OSPF ECMP steps in to handle load balancing and failure resilience, so we can actually utilize all our uplink bandwidth simultaneously instead of having ports sitting idle in a blocking state.

Here is how our five nodes fit into this new, modernized architecture:

🚦 Getting Started with VLANs and Subnetting

Now that the routed architecture is officially decided, it was time to tackle the logical side: IP addressing.

Because VLANs and SVIs will now live right on the access switches with purely routed upstream links, my old CCNA addressing scheme wasn't going to cut it. I needed a clean, scalable subnetting plan that would play nicely with our new routed design and give this rebuild a much cleaner path forward. I will admit that what I've come up with is a chaotic combination of lots of research, and plenty of arguing with AI about why X is better than Y 😂 — but I'm honestly still proud of the outcome!

P.S.: Feel free to give me tips on how to improve this plan in the LinkedIn comments or PM me. I know it can be better, and I want to learn from you all! 🙏

📈 A Scalable Private Addressing Plan

Instead of sticking with the tired old 192.168.x.x layout, our rebuilt enterprise topology is graduating to the massive private 10.0.0.0/8 space! This format makes the site and network function instantly readable just by glancing at the address, and it leaves plenty of room for future branches.

Fair warning: we are about to dive deep into the subnetting weeds! 🌿 But by making every single octet actually mean something, this network will effectively document itself. Let's break down the logic:

Dual-stack host allocation

Every standard HQ endpoint VLAN follows the same paired convention: an IPv4 /24 and IPv6 /64, with .1 and ::1 reserved for the SVI default gateways.

🔁 Loopback allocation plan

Think of loopbacks as a device's permanent nametag. 🏷️ By using one consistent format across every site, we give every router and switch a stable, unbreakable identity for SSH and management, completely independent of whatever physical interfaces are bouncing up and down.

📝 Addressing Summary

ip domain name hq.example.test
! Lab baseline only: centralized AAA and management filtering come later
username admin privilege 15 secret <secret>
enable secret <secret>
crypto key generate rsa modulus 2048
ip ssh version 2
no ip http server
no ip http secure-server

! Timeouts are extended for labbing purposes
line console 0
exec-timeout 30 0
 logging synchronous

line vty 0 6
 login local
 transport input ssh
 exec-timeout 10 0

Each device gets its own secure secret values, while the shared baseline keeps our console sessions tidy. 🤫