🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › IT Support / Networking › Capstone Project: Integrated IT Support and Network Build › Lesson 2
TEC-ITS43-07 · Lesson 2 · 64 clock hours · lab

Physical Build, OS Deployment, and Network Configuration

Objective. The student will assemble the hardware environment, install and configure operating systems, and configure a managed switch and router so that all devices pass connectivity and VLAN tests documented in the verification plan.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Physical Build, OS Deployment, and Network Configuration

This lab brings together every skill from the program into one integrated build. You will assemble workstations, install an operating system, and configure a managed switch and router — then verify that everything works using a structured checklist. Work methodically, document as you go, and treat safety as a non-negotiable step, not an afterthought.

Safety First: ESD and Physical Hazards

Electrostatic discharge (ESD) can permanently damage CPUs, RAM, and storage devices — often without any visible sign of damage. Before touching any component, attach an ESD wrist strap to your wrist and clip it to a grounded metal surface such as the unpainted chassis of the case. Work on an antistatic mat when available. Keep components in their antistatic bags until the moment you install them. Never work inside a powered system; disconnect power and press the power button once to drain residual charge. When racking equipment, use a second person or a rack-lift for heavy chassis to prevent back injury.

Assembling the Workstations

Begin with a clean, well-lit work surface. Install the CPU into the motherboard socket using zero-insertion-force (ZIF) technique — align the triangle marker and lower it straight down without pressing. Apply thermal paste only when required (boxed coolers with pre-applied paste need none): a pea-sized dot centered on the CPU die is the standard method; the cooler spreads it under pressure. Seat RAM in the correct slots per the motherboard manual (usually slots 2 and 4 for dual-channel). Install the storage drive, GPU if present, and power supply connections. Route all cables behind the motherboard tray or through cable management channels before closing the case. Use cable ties and a label maker so each cable is identified at both ends — this practice is required for the verification checklist and reflects real-world professional standards.

Take a timestamped photo at each milestone: before power-on, after POST, and after OS installation. Photos become your project log and evidence for instructor verification.

Installing Windows 11 Pro

Create a bootable USB with the Windows 11 installation tool from Microsoft. Boot the target machine from USB (adjust BIOS/UEFI boot order), choose a clean install, select the correct partition, and complete setup. Join both machines to a local workgroup rather than a domain — use a consistent naming convention such as WS-01 and WS-02. After installation, install drivers from the motherboard and GPU manufacturer, run Windows Update fully, and enable Windows Defender. Document the hostname, IP address (static or DHCP-assigned), and workgroup name in the project log.

Configuring the Managed Switch

Connect to the switch via console cable and terminal emulator (PuTTY at 9600 baud is standard for Cisco). Enter privileged EXEC mode (`enable`) and then global configuration mode (`configure terminal`). Create at least two VLANs: a data VLAN (commonly VLAN 10) and a voice or management VLAN (commonly VLAN 20). Assign access ports to each VLAN with `switchport mode access` and `switchport access vlan <id>`. Configure the uplink port to the router as a trunk: `switchport mode trunk`. Enable Spanning Tree Protocol (STP) — it is on by default in Cisco IOS as PVST+, but verify with `show spanning-tree`. Confirm your configuration with `show vlan brief` and `show interfaces trunk`, and paste the output into your verification table.

Configuring Inter-VLAN Routing

On a Cisco ISR router (or pfSense equivalent), use router-on-a-stick: create subinterfaces on the physical interface connected to the switch trunk. Example for VLAN 10:

```

interface GigabitEthernet0/0.10

encapsulation dot1Q 10

ip address 192.168.10.1 255.255.255.0

```

Repeat for VLAN 20. Enable the parent interface with `no shutdown`. Devices on VLAN 10 will use 192.168.10.1 as their default gateway; devices on VLAN 20 will use 192.168.20.1. Test inter-VLAN connectivity with pings from a host on each VLAN to the gateway and to a host on the other VLAN. Record every ping result — success and failure — in the verification table.

DHCP, Wireless, and Cloud Backup

Configure a DHCP scope on the router or on a pfSense/Windows Server VM. Define the pool, default gateway, DNS server, and lease time. Exclude static addresses from the pool. Connect the wireless access point and configure SSID and security: use WPA3-Personal if the hardware supports it; use WPA2-AES if not — never use WEP or TKIP. Install a cloud backup agent on one workstation and verify a successful backup to a free-tier or lab cloud storage account. Screenshot or log the backup completion timestamp.

The 24-Point Post-Installation Checklist

The checklist covers three categories: physical (cable management, labels, no exposed conductors, cooler seated, chassis closed), logical (VLANs exist, trunk active, DHCP assigns addresses, pings pass, workstations joined to workgroup, backup agent running), and security (WPA3/WPA2 enabled, default switch passwords changed, Windows Defender active, Windows Update current, unnecessary services disabled). Each item is marked PASS or FAIL. You must achieve at least 22 of 24 passing items before moving to documentation. Any failed item must be corrected on the spot.

Key terms8

ESD wrist strapA grounded strap worn on the wrist during component handling to equalize electrical potential between the technician and the hardware, preventing electrostatic discharge damage.
VLAN (Virtual Local Area Network)A logical segmentation of a physical switch that separates broadcast domains, allowing different groups of devices to behave as if they are on separate networks even when connected to the same hardware.
Trunk portA switch port configured to carry traffic for multiple VLANs simultaneously, tagging frames with IEEE 802.1Q headers so the receiving device knows which VLAN each frame belongs to.
Router-on-a-stickAn inter-VLAN routing method in which a single router interface handles traffic for multiple VLANs through logically divided subinterfaces, each assigned a VLAN ID and IP gateway address.
Spanning Tree Protocol (STP)A Layer 2 protocol (IEEE 802.1D and variants) that detects and logically disables redundant switch paths to prevent broadcast loops, while keeping backup paths available if a primary path fails.
WPA3-PersonalThe current Wi-Fi Protected Access standard for home and small-office networks, using Simultaneous Authentication of Equals (SAE) for stronger password-based authentication than WPA2.
DHCP scopeA defined range of IP addresses on a DHCP server that the server can lease to clients, along with options such as default gateway, subnet mask, and DNS server addresses.
dot1Q encapsulationThe IEEE 802.1Q tagging standard used on router subinterfaces and switch trunk links to identify which VLAN a frame belongs to by inserting a 4-byte tag into the Ethernet frame header.
In class: Build two end-user workstations (component installation, cable management, ESD wrist-strap use, thermal paste application where required), install Windows 11 Pro via bootable USB, join both machines to a local workgroup, and document each step with timestamped photos in the project log. · Configure a managed switch with at least two VLANs (data and voice/management), set trunk and access ports, enable spanning tree, and configure a router subinterface for inter-VLAN routing; verify with 'show vlan brief', 'show interfaces trunk', and end-to-end pings recorded in a verification table. · Deploy a DHCP scope on the router or a Windows Server/pfSense VM, configure a wireless access point with WPA3-Personal (or WPA2 if hardware requires), connect a cloud backup agent to a free-tier or lab cloud storage account, and run a 24-point post-installation checklist covering physical, logical, and security items.
Materials: Lab workstation components (or existing lab PCs), managed Layer-2 switch (Cisco Catalyst or equivalent), router (Cisco ISR or pfSense on lab hardware), wireless access point, Cat 6 patch cables, ESD wrist straps, cable ties, label maker, Windows 11 Pro installation media, Cisco IOS CLI reference, pfSense documentation, CompTIA A+ Core 1 and Core 2 exam objectives (current version)
Check: Instructor performs a live walk-through verification using the student's own verification table; all 24 checklist items must pass (PASS/FAIL per item); student must achieve 22/24 passing items; failed items are corrected before the documentation phase begins.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA A+ Core 1 — Hardware
1. A technician is installing a CPU and notices the boxed cooler has a gray pad already attached to its base. What is the correct action regarding thermal paste?
Cisco CCNA / CCST — Switching
2. Which command verifies that VLANs have been created on a Cisco switch and shows which ports are assigned to each VLAN?
Cisco CCNA — Routing
3. A router subinterface is configured with 'encapsulation dot1Q 20' and IP address 192.168.20.1/24. What is the purpose of the encapsulation statement?
CompTIA Network+ / Cisco CCNA — Switching
4. Spanning Tree Protocol is enabled on a Cisco switch. A redundant uplink cable is added between two switches. What will STP do automatically?
CompTIA Network+ / CompTIA A+ Core 2 — Security
5. A technician configures a wireless access point. The hardware supports WPA3-Personal and WPA2-AES. Which security setting should be chosen?
Cisco CCNA / CCST — Routing and Switching
6. After completing the switch and router configuration, a workstation on VLAN 10 cannot ping a workstation on VLAN 20. The pings reach the VLAN 10 gateway but go no further. What is the most likely cause?
CompTIA A+ Core 1 — Safety and Environmental Concepts
7. During workstation assembly, why must the technician press the power button once after unplugging the power cord before touching internal components?
Cisco CCNA / CompTIA Network+ — IP Services
8. A DHCP scope is configured on a router with the pool 192.168.10.10–192.168.10.200. The router's own subinterface IP is 192.168.10.1. What configuration step is required to ensure the router's IP is never assigned to a client?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →