Skip to content

Switching, IPv6 & Wireless

Beyond basic routing, the MCP can build and configure VLANs, dual-stack IPv6, wireless clients, and apply layer-2 / device hardening — all verified live against Packet Tracer.

VLANs & inter-VLAN routing (router-on-a-stick)

Build a one-armed router that routes between VLANs using .1q subinterfaces:

"Build a router-on-a-stick with 3 VLANs and 6 PCs, DHCP."

The LLM calls:

pt_full_build(template="router_on_a_stick", vlans=3, pcs_per_lan=6, dhcp=True)

What you get:

  • N VLANs spread across the PCs (ids 10, 20, 30, …), each its own /24 + DHCP pool.
  • The switch uplink becomes a trunk; PC ports become access ports in their VLAN.
  • The router gets one subinterface per VLAN (GigabitEthernet0/0.10, …0.20, …) with encapsulation dot1Q <id> and the VLAN gateway IP — so inter-VLAN routing just works.

2960 vs 3560 trunks

On a 2960-24TT (dot1q-only) the generator omits switchport trunk encapsulation; on a 3560-24PS (multi-encap) it emits switchport trunk encapsulation dot1q.

To add VLANs to an already-deployed topology, use pt_apply_vlan:

pt_apply_vlan(
  switch="SW1", router="R1",
  vlans=[{"vlan_id":10,"name":"SALES"},{"vlan_id":20,"name":"ENG"}],
  access_ports=[{"switch":"SW1","port":"FastEthernet0/1","vlan_id":10},
                {"switch":"SW1","port":"FastEthernet0/2","vlan_id":20}],
  trunks=[{"switch":"SW1","port":"GigabitEthernet0/1"}],
  subinterfaces=[{"router":"R1","parent_port":"GigabitEthernet0/0","vlan_id":10,"ip_cidr":"192.168.10.1/24"},
                 {"router":"R1","parent_port":"GigabitEthernet0/0","vlan_id":20,"ip_cidr":"192.168.20.1/24"}],
  dry_run=True)   # preview the CLI before applying

IPv6 dual-stack

Add IPv6 alongside IPv4 with one flag:

pt_full_build(routers=2, dual_stack=True)
  • Routers get ipv6 unicast-routing + ipv6 address <prefix>::1/64 per interface (via CLI).
  • Hosts use SLAAC — they auto-configure from the router's Router Advertisements (configurePcIpv6 enables IPv6 + address auto-config).

Static host IPv6 is not available

Packet Tracer's Script Engine rejects addIpv6Address on host ports, so end devices use SLAAC rather than a hardcoded address. Routers carry the explicit ipv6 address.

Wireless laptops

Connect Laptop-PTs over WiFi instead of a cable:

pt_full_build(laptops_per_lan=2, wireless_laptops=True)
  • Each laptop's wired NIC is swapped for a wireless card (PT-LAPTOP-NM-1W → Wireless0).
  • An Access Point is added and wired to the switch; laptops auto-associate on the default SSID. One AP is created per LAN, wired to that LAN's switch. PT's logical view has global RF range and exposes no SSID API, so association is not proximity-based: a wireless host may associate to any AP and get a lease from another LAN's pool. The plan warns with WIRELESS_AMBIGUOUS_ASSOCIATION; verify with pt_inspect_ports.
  • Wireless hosts pull a DHCP lease over the air, landing on the same LAN as the wired PCs.

AP SSID / WPA2 is GUI-only

Packet Tracer does not expose Access-Point SSID / security through its Script Engine, so custom SSID/WPA2 must be set in the AP's GUI. The default-SSID association works out of the box.

Layer-2 security & device hardening

All of these are config-driven and accept dry_run=True to preview the CLI:

Tool Example
pt_apply_stp pt_apply_stp(switch="SW1", root_primary_vlans=[10], portfast_ports=["FastEthernet0/1"])
pt_apply_port_security pt_apply_port_security(switch="SW1", port="FastEthernet0/1", max_mac=2)
pt_apply_hardening pt_apply_hardening(device="R1", enable_secret="cisco", users=[{"username":"admin","secret":"pass","privilege":15}], ssh={"domain":"lab.local"})
pt_apply_interface_tuning pt_apply_interface_tuning(router="R1", interface="Serial0/0/0", clock_rate=64000)

Verifying a deployment

After a deploy, reconcile what the plan intended against what PT actually has:

pt_diff(plan_json=...)   # missing/extra devices, IP mismatches
pt_health_check()        # down links, cabled-without-IP, duplicate IPs

pt_live_deploy also auto-reconciles — if PT silently drops a device (a known quirk with Laptop-PT), it re-adds the missing devices/links and re-verifies in the same call.