Network administrator projects should demonstrate design, configuration, monitoring and troubleshooting—not just a successful ping. These ten labs produce concrete portfolio evidence for junior network, infrastructure and support roles without requiring a rack of expensive hardware.
If network administration is your chosen path, our first IT job guide for Australia explains how to turn portfolio evidence into targeted applications and interview answers.
Start with a simulator: Cisco Packet Tracer is approachable for fundamentals; GNS3 and EVE-NG support more complex virtual appliances when you have legal images and sufficient resources. Work only on networks and cloud accounts you own or have explicit permission to test.
Choose a project by skill
| Project | Main skills | Difficulty | Best evidence |
|---|---|---|---|
| Branch topology | Subnetting, routing, diagrams | Beginner | Address plan and packet path |
| VLAN segmentation | 802.1Q, ACLs, inter-VLAN routing | Intermediate | Allowed and blocked traffic tests |
| Core services | DHCP, DNS, NTP, IPAM | Beginner | Lease, lookup and failure tests |
| Remote access | VPN, identity, routes, MFA design | Intermediate | Connection and access matrix |
| Monitoring | SNMP, telemetry, alerts, baselines | Intermediate | Dashboard and incident timeline |
| Resilience | Redundancy, failover, convergence | Advanced | Measured recovery test |
| Wireless design | Coverage, channels, guest isolation | Intermediate | Survey and configuration rationale |
| Cloud network | VPC/VNet, routes, security controls | Intermediate | Diagram and cost-safe teardown |
| Automation | APIs, templates, config backup | Advanced | Versioned script with dry run |
| Troubleshooting drill | OSI model, packet capture, reporting | Intermediate | Fault timeline and postmortem |
1. Design a small branch network
Create a headquarters and two-branch topology with routers, switches, clients and shared services. Build an IPv4 addressing plan, assign subnets with room for growth and select static routes or a dynamic routing protocol appropriate to the lab.
Document the path between a branch user and a server. Capture route tables, interface status and one packet flow. Then break a route and explain how you isolated the fault.
2. Segment users, servers and guests with VLANs
Build separate VLANs for users, servers, voice, management and guests. Configure access and trunk ports, inter-VLAN routing and an access-control policy. Your test plan should prove both what is allowed and what is blocked.
Add a management rule that permits administration only from a designated subnet. Explain how the design limits broadcast traffic and reduces lateral movement without claiming that VLANs alone provide complete security.
3. Operate DHCP, DNS and time services
Deploy DHCP scopes with exclusions, reservations, lease times and the correct gateway and DNS options. Build forward and reverse DNS records, configure a reliable time source and create a simple IP-address inventory.
Test a normal lease, an exhausted scope, a wrong DNS record and an unavailable server. Record the client symptoms and the commands or tools used to diagnose each problem.
4. Build secure remote access
Create a lab remote-access VPN using a firewall appliance or a supported cloud service. Define who can connect, which internal networks they can reach, how authentication is protected and how access is logged. Use test identities, not personal or production credentials.
Document full-tunnel versus split-tunnel trade-offs, DNS behaviour, route advertisement and a revocation procedure. Include failure tests for an expired credential and a user without the required group membership.
5. Monitor availability and performance
Monitor device reachability, interface status, errors, discards, bandwidth, CPU, memory, latency and packet loss. Establish a normal baseline before creating alerts. Use SNMPv3 or another secure method where supported instead of treating insecure defaults as best practice.
Trigger a harmless outage, trace when the alert fired and document the recovery. The OpManager comparison explains where network monitoring differs from endpoint management.
6. Test gateway and link failover
Create a redundant gateway or dual-path topology with first-hop redundancy and a dynamic routing protocol. Define the expected failure behaviour, then disable an interface and measure convergence and packet loss. Restore it and check whether routing returns cleanly.
Publish before-and-after route tables and a short explanation of the failure domain. If the simulator cannot reproduce a feature accurately, say so rather than presenting an assumption as a measured result.
7. Plan a secure wireless network
Survey a small home or office space, note interference and construction materials, and propose access-point locations and channels. Separate corporate and guest traffic, describe authentication options and define how devices are onboarded and removed.
Use a Wi-Fi analyser only where legal and with permission. A useful portfolio entry explains why each design choice was made; a screenshot of nearby networks adds little value and may expose other people’s information.
8. Build a cost-controlled cloud network
Create a small Azure VNet or AWS VPC with public and private subnets, route tables, security groups or network security groups, and a controlled administration path. Enable flow logging if the lab budget allows and set a cost alert before deployment.
Test which connections succeed, explain the effective route and tear the lab down when finished. Never publish cloud account identifiers, secrets or public management endpoints.
9. Automate configuration backup and validation
Use Python, Ansible or a vendor API to retrieve configurations from lab devices, store sanitised versions in Git and compare changes. Add input validation, structured logs, error handling and a dry-run mode before attempting any configuration write.
Create a policy check for an approved NTP server, management ACL or interface description. Report drift instead of automatically “fixing” every difference until the safe remediation path is proven.
10. Run a structured troubleshooting drill
Ask a friend to introduce one fault—or choose from a prepared list without looking. Possibilities include the wrong VLAN, disabled interface, bad default gateway, DNS failure, duplicate IP or missing route. Start with the symptom, form a hypothesis, test it and record evidence.
Finish with a short incident report: impact, timeline, root cause, restoration, verification and one preventive improvement. This demonstrates the calm method employers need when a real user says only, “the network is down”.
Portfolio checklist
- A diagram with device roles, interfaces, subnets and trust boundaries
- A small configuration sample with passwords, keys and public addresses removed
- A test matrix covering expected success and expected denial
- One failure scenario and a timestamped troubleshooting trail
- A rebuild, rollback or restore procedure
- Clear limitations and what would change at enterprise scale
Continue building your IT portfolio
Connect a networking lab to one of the system administration projects, then add a controlled defensive exercise from the cybersecurity project list. The result is a more realistic environment where identity, endpoints, services and the network interact. My entry-level IT resume and portfolio guide explains how to present that network evidence to employers without overstating a lab as production experience.
Updated: July 2026. Use only networks, images, licences and cloud accounts you are authorised to operate. Sanitize every configuration before publishing it.