Cisco Packet Tracer – How to Simulate a MAC Flooding Attack

Ok, I think there are two variants to look into this, the problematic part where it divides is when you mentioned OSPF should be used for internal routing. If you want to reach other destination through ISP and use OSPF between sites the ISP routers needs to be part of your OSPF topology, so they would propagate all the networks with OSPF through the whole topology. This picture shows it.

Notice the orange region is also on links between offices, so they are part of OSPF.

The problem here is, that this wouldn't be really possible in real life. You can't manage ISP network, so the solution here is to create GRE Tunnels between every office. That way, the OSPF would use Tunnel interfaces, and from logical part of network it will look like the routers Office A, Office B, Office C are directly connected and can establish neighbours in OSPF through these Tunnel interfaces.

For PAT, I guess you also ment one IPv4 address per OFFICE, not per city. It makes much more sense, that means you will make PAT on every Office router and ISP network uses public addresses to connect between cities. You should also use some dynamic routing / static routing in ISP network, to make sure every ISP router can reach public address of office router ( if you go with the way of GRE tunnels. Having ISP routers part of OSPF topology loose the purpose of PAT, because they can directly see on the inside networks).

Within one office, users in different VLANs will be reachable by inter-VLAN routing (either on L3 switch or router-on-stick solution with subinterfaces). If they want to reach other site directly and you are using PAT, there needs to be GRE tunnel between sites allowing direct L3 connection. I guess you don't want to create rules in PAT for every user.

So to sum it up, I think the best solution here is to do GRE tunnels between sites and do OSPF on these interfaces to manage internal network. For external network (ISP) use again OSPF or EIGRP, whatever works for you.

Spanning tree sends BPDUs, and these will have the source MAC address of the sending switch. A switch will populate its MAC address table with the source MAC address on any frame entering the interface.

You really don't want to set up port security with a MAC address limitation on a link between two switches, and you certainly do not want to disable STP where you have two switches connected.