JAJerry Atchison
Bachelor of Science in Cloud and Network Engineering • Implemented network capstone

GadgetMotion Hybrid Cisco-AWS Robotics Network

Implemented a Cisco CML and AWS hybrid network that separated engineering, robot-testing, and firmware systems while extending controlled access to cloud simulation and logging services through an IPsec site-to-site VPN.

← Back to portfolio Open full architecture diagram
Complete GadgetMotion hybrid Cisco and AWS network architecture
Complete hybrid architecture showing the three on-premises VLANs, Cisco routing and ACL enforcement, two AWS subnets, and the IPsec VPN connection. Select the diagram to open it at full resolution.
My role: I designed the topology, configured the Cisco switching and routing, built the AWS network, established the VPN, created the access-control policies, troubleshot connectivity, and documented repeatable validation steps.
3 VLANsEngineers, robot testing, and firmware services
2 AWS subnetsSimulation and log-analysis workloads
8 test areasLayer 2, Layer 3, cloud, VPN, and security

Project objective

GadgetMotion needed a private environment for prototype robot designs and firmware while still allowing approved systems to use AWS simulation and logging resources. I built the solution as a hybrid lab so the on-premises and cloud networks could communicate over an encrypted connection without placing protected systems directly on the public internet.

Architecture and segmentation

On-premises Cisco network

Two IOSvL2 switches carried three VLANs over an 802.1Q trunk. VLAN 10 supported engineering workstations, VLAN 20 contained robot-test systems, and VLAN 30 hosted the firmware/configuration server. Router R1 provided router-on-a-stick inter-VLAN routing, DHCP for the user VLANs, and ACL enforcement.

AWS network

The AWS VPC used a 10.0.0.0/16 address range with a simulation subnet and a log-analysis subnet. Route tables provided internal VPC routing, the simulation server used dynamically assigned addressing, and the logging server retained a static private address.

Hybrid connection

An IPsec site-to-site VPN connected R1 to an AWS Virtual Private Gateway. AWS route tables included the on-premises networks, and security groups extended the access policy across the hybrid boundary.

Eight validation areas

  1. VLAN and trunk segmentationVerified VLAN membership, access ports, the SW1-SW2 trunk, same-VLAN communication, and Layer 2 paths.
  2. DHCP and static addressingValidated DHCP pools for the engineering and robot VLANs while the firmware server retained a static address.
  3. Inter-VLAN reachability and ACLsAllowed engineers to reach the firmware server while denying the robot VLAN.
  4. AWS subnet segmentationConfirmed the VPC, two /24 subnets, route-table associations, and internal cloud routing.
  5. Cloud addressing and external routingChecked dynamic and static cloud addressing, Internet Gateway routing, and outbound connectivity.
  6. Cloud security-group behaviorTested allowed and denied communication between EC2 instances in separate subnets.
  7. IPsec VPN operationVerified tunnel status, ISAKMP and IPsec security associations, routes, packet counters, and bidirectional traffic.
  8. Hybrid network securityAllowed the engineering and server VLANs to reach the simulation server while blocking the robot VLAN at the AWS boundary.

Selected validation evidence

The screenshots below come from the functionality testing I performed in Cisco Modeling Labs and AWS. They show the configured VLANs, successful permitted traffic, intentional denials, and communication across the hybrid connection.

VLAN tables on GadgetMotion switches
VLANs 10, 20, and 30 configured across both switches with the expected access-port assignments.
Same-VLAN connectivity validation in Cisco CML
Same-VLAN ping and traceroute tests completed with 0% packet loss and a direct Layer 2 path.
Cisco ACL that blocks robot systems from the firmware server
The ACL denied the robot subnet from reaching the protected firmware server and permitted other traffic.
Engineer workstation successfully reaching firmware server
Authorized engineering traffic reached the firmware server with 0% packet loss.
Robot test system blocked from firmware server
The robot-test VLAN was intentionally denied, producing 100% packet loss.
Engineering workstation reaching both AWS servers through the VPN
An engineering workstation reached both AWS subnets across the site-to-site VPN.
Robot VLAN permitted before and blocked after AWS security group policy change
Before-and-after testing showed the robot VLAN become blocked after the AWS security-group rule was removed.
Engineering VLAN remains allowed to AWS simulation server
The engineering VLAN remained permitted to reach the simulation server after the policy change.

Results

  • Verified VLAN membership, 802.1Q trunking, DHCP, static addressing, routing, and ACL placement.
  • Confirmed permitted paths with successful replies and 0% packet loss.
  • Confirmed intended denied paths with 100% packet loss.
  • Validated VPC subnet routing, route-table entries, and security-group enforcement.
  • Confirmed both VPN tunnels were operational and observed encrypted packet counters increase during testing.
  • Demonstrated bidirectional connectivity between approved on-premises systems and AWS resources.

Troubleshooting work

  • Learned that Cisco Modeling Labs required fetching each device configuration rather than downloading only the topology, preventing configuration loss between sessions.
  • Diagnosed asymmetric ACL behavior when return traffic to the robot VLAN was denied on the inbound VLAN 20 subinterface.
  • Determined the external endpoint presented through the CML NAT environment so the AWS customer gateway and VPN could be configured correctly.
  • Checked route tables, tunnel status, ISAKMP and IPsec security associations, and packet counters when validating end-to-end reachability.